Researchers Show How GNU Savannah Flaw Could Have Put Bash's Source Code at Risk

Researchers at Hacktron have described how a flaw in GNU Savannah, the platform that hosts the Bash shell, Coreutils and hundreds of other GNU projects, could have given an attacker a route into some of the most widely used software in the world. According to the researchers, a specially crafted email address registered by any ordinary user was enough to run commands on the platform's backend.

The team says the problem lay in Savane, the free PHP application that runs Savannah. Its email validator accepted unusual characters that are technically allowed in email addresses, and those characters were later used unsafely when the site ran a GPG key check. From there, the researchers report they made their own account a superuser, impersonated Bash's maintainer, and confirmed they could add an SSH key with push access to the upstream Bash repository. An unpatched kernel also gave them root access and reach into a GNU backup server.

Hacktron reported the issue to the Free Software Foundation (FSF) on 11 May 2026, then tested the rest of Savane and reported further bugs, for a total of 26 confirmed vulnerabilities. The FSF has fixed them and published an incident report. The researchers point to the xz backdoor as a reminder of what one compromised link in the software supply chain can do, since code hosted on Savannah is packaged by distributions and installed on millions of machines.