GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
n/a — n/a
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
9.8
100.0%
Vector breakdown
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- Sep 24, 2014
- Modified
- Jun 17, 2026
- Added to KEV
- Jan 28, 2022
- Federal patch due
- Jul 28, 2022
CISA required action
Apply updates per vendor instructions.
Weakness classification
Affected packages
Proof-of-concept & exploitation references
8 foundWeaponization
Public repositories whose name or description references CVE-2014-6271, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit - cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.
- opsxcq/exploit-CVE-2014-6271★ 231
Shellshock exploit + vulnerable environment
updated Aug 7, 2026
- scottjpack/shellshock_scanner★ 46
Python Scanner for "ShellShock" (CVE-2014-6271)
updated Mar 26, 2026
- hmlio/vaas-cve-2014-6271★ 22
Vulnerability as a service: showcasing CVS-2014-6271, a.k.a. Shellshock
updated Oct 13, 2025
- b4keSn4ke/CVE-2014-6271★ 15
Shellshock exploit aka CVE-2014-6271
updated Jun 13, 2026
- cj1324/CGIShell★ 13
shellshock CVE-2014-6271 CGI Exploit, Use like Openssh via CGI
updated Aug 12, 2024
- francisck/shellshock-cgi★ 12
A python script to enumerate CGI scripts vulnerable to CVE-2014-6271 on one specific server
updated Apr 25, 2024
- indiandragon/Shellshock-Vulnerability-Scan★ 11
Android app to scan for bash Vulnerability - CVE-2014-6271 also known as Shellshock
updated Nov 10, 2025
- P0cL4bs/ShellShock-CGI-Scan★ 6
A script, in C, to check if CGI scripts are vulnerable to CVE-2014-6271 (The Bash Bug).
updated Aug 12, 2024
References
- advisories.mageia.org
- archives.neohapsis.com
- jvn.jp
- jvndb.jvn.jp
- kb.juniper.net
- lcamtuf.blogspot.com
- linux.oracle.com
- linux.oracle.com
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- marc.info
- marc.info
How this class of flaw gets exploited
Frequently asked questions
What is CVE-2014-6271?
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
How severe is CVE-2014-6271?
CVE-2014-6271 has a CVSS base score of 9.8 out of 10 (CVSS 3.1).
Is CVE-2014-6271 actively exploited in the wild?
Yes. CVE-2014-6271 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Jan 28, 2022, meaning CISA has confirmed evidence of active exploitation.
What is the EPSS score for CVE-2014-6271?
100.0% - meaning FIRST.org's EPSS model estimates a 100.0% probability this vulnerability will be exploited in the wild within 30 days (100% percentile among all scored CVEs).
Is there exploit tooling available for CVE-2014-6271?
Yes - a public Nuclei template referencing CVE-2014-6271 exist in public repositories we checked. We also found 8 public GitHub repositories referencing this CVE.
What type of vulnerability is CVE-2014-6271?
CVE-2014-6271 is classified under CWE-78 (CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')).
Cross-checked against
Impactr finds and proves whether CVE-2014-6271 - or flaws like it - are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.
Join the waitlist