GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Apache
Command Injection
Qnap
IBM
Apple
+86
NVD
Exploit-DB
VulDB
CVSS 3.1
9.8
EPSS
90.1%
Threat
7.7