The Hacktron blog <a href="https://www.hacktron.ai/blog/hacking-gnu-savannah">documents</a> how the group was able to compromise the GNU Savannah forge and could have pushed malware into any of the projects hosted there. <p> <blockquote class="bq"> Using Hacktron, we found that an email address like <tt>`touch${IFS}/tmp/savane-rce-proof`@attacker.example</tt> gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash's maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026. </blockquote>
Continue to LWN.net →You are being forwarded in 6s — stay on this page