Home Search Pricing Get inErrata About

Sign in Sign up

Graph/cc1fa3ba-85f0-45f3-ac04-cc4a7e8880c8

Problemunvalidated

a command injection is still possible — In non-POSIX mode (posixly_correct == 0, the default). Tension: the incomplete CVE-2014-6271 (Shellshock) fix.

cc1fa3ba-85f0-45f3-ac04-cc4a7e8880c8

a command injection is still possible — In non-POSIX mode (posixly_correct == 0, the default). Tension: the incomplete CVE-2014-6271 (Shellshock) fix.

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

20 linked nodes

CAUSED_BYRootCause

the legal_identifier check is skipped due to short-circuit evaluation in a conditional — when posixly_correct is 0 (the default). Tension: allowing function names to contain shell metacharacters like backticks or command substitution syntax. Outcome: parse_and_execute(temp_string, ...) processes the constructed string containing unvalidated tname.

CAUSED_BYProblem

when posixly_correct is 0 (the default). Tension: the validation of function names extracted from environment variable names is insufficient.

PERTAIN_TODomain

PERTAIN_TODomain

Command Injection

PERTAIN_TODomain

FIXED_BYSolution

it is possible, if you will run the suspicious application on a virtual machine — for the described attack. Tension: you would be able to notice all kinds of issues. Outcome: QEMU - an existing open source virtual machine.

FIXED_BYSolution

`load` is still available. — if I set `os` and `io` to `nil` before running the script. Tension: will it completely prevent user from gaining access to those standard libraries? Outcome: This will allow loading malicious bytecode.

FIXED_BYSolution

Change line 361 from `if (posixly_correct == 0 || legal_identifier(name))` to `if (legal_identifier(name))` — This ensures that variable names used as function definitions always contain only legal shell identifier characters. Tension: preventing injection of shell metacharacters. Outcome: The variable name must pass validation before being concatenated into the command string that will be parsed and executed.

FIXED_BYSolution

The vulnerability requires validating that function definition variables contain ONLY a valid function definition. — Bash 4.4+ includes a proper fix by validating function definitions during the parsing phase. Tension: The parser was modified to reject function definitions that have trailing code after the closing brace.

FIXED_BYSolution

fixed pre-bash-4.4-beta2 in variables.c:assign_hashcmd lines 1764-1785 — Bash <= 5.0 restricted shell (rbash). Tension: restricted shell (rbash) can be bypassed.

FIXED_BYSolution

before `ijs_invoke_server(ijsdev->IjsServer)`. Tension: This re-applies the --permit-file-write allowlist that the IJS off-ramp currently skips. Outcome: stop using `execvp("sh","-c",server_cmd)`.

FIXED_BYSolution

The durable fix moved function imports under a distinct env-var prefix `BASH_FUNC_name%%` — Upstream remediation evolved across multiple patches. Tension: ad-hoc string checks proved insufficient. Outcome: the function importer is a separate, dedicated parser and the general env loop never feeds attacker text to parse_and_execute.

FIXED_BYSolution

The vulnerability can be fixed by sanitizing the fname parameter before passing to popen(). Tension: Validate that fname contains only safe characters and reject filenames containing shell metacharacters (|, ;, &, $, backtick, etc.). Outcome: Alternatively, use posix_spawn() with execv array instead of popen() to avoid shell interpretation entirely. The most secure solution is to disable the pipe device by default and require an explicit security flag to enable it.

FIXED_BYSolution

Found vulnerability through source code audit of coreutils-8.20 — key files examined: src/sort.c. Tension: the issue.

OCCURS_INLanguage

OCCURS_INPackage

OCCURS_INLanguage

OCCURS_INComponent

Token Request Parameterization

CVE-2014-7169: Bash Shellshock incomplete fix – command injection via function import in non-POSIX mode

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata