GNU Savannah hatte 'ne Shell injection in der E-Mail-Adresse, mit der man sich registriert
TL;DR: GNU Savannah hosts Bash, Coreutils, and hundreds of other GNU projects. Using Hacktron, we found that an email address like a
`touch${IFS}/tmp/savane-rce-proof`@attacker.examplegave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026.
Den Bericht gibt's hier. Das ist in etwa die Dimension “the winner takes it all”.