CVE-2014-6278 GNU Bash OS Command Injection

Exploited in the wild High 8.8 Published 30 Sep 2014 Updated 30 Dec 2025

Remote attackers can execute arbitrary commands via crafted environment variables due to improper parsing of function definitions in GNU Bash.

Exploited in the wild: Since 2 Oct 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2014-6278?

CVE-2014-6278 is a high-severity command injection vulnerability in n/a, published on 30 Sep 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

Weakness: CWE-78

Which versions are affected by CVE-2014-6278?

It affects 1 product.

Products include Gnu Bash.

How do I fix CVE-2014-6278?

Apply the vendor's patch. US federal agencies must fix it by 23 Oct 2025.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2014-6278 being exploited?

Yes. Attackers have exploited CVE-2014-6278 in the wild since at least 2 Oct 2025.

Public exploit code: 3 Metasploit modules and 5 Exploit-DB entries.

Sources

Also known as DEBIAN-CVE-2014-6278, GHSA-6493-28fj-f93w, UBUNTU-CVE-2014-6278.