AI security testing firm Hacktron published research on 30 October 2026 saying that an email address containing a shell command in backticks gave any registered user code execution on the backend of GNU Savannah, the Free Software Foundation's code forge that hosts Bash, Coreutils and other GNU projects.

According to Hacktron, Savannah's Savane software accepted the address at registration, then inserted it unsanitised into a gpg command line when a user clicked 'Test GPG keys'.

Hacktron says it used the resulting shell to read the database credentials, made its own account a superuser, impersonated Bash maintainer Chet Ramey and confirmed that his settings page would accept an extra SSH key with push access to the upstream Bash repository: "We did not add a key and we did not touch the repository."

It says an unpatched 2023 kernel flaw, GameOver(lay) (CVE-2023-2640 and CVE-2023-32629), then gave it root on the Savannah backend and a key to a GNU backup host.

Hacktron says the FSF traced the vulnerable code to the Savane release of 7 March 2026, affecting savannah.gnu.org and savannah.nongnu.org.

Its timeline says it reported the issue on 11 May 2026, the FSF installed a fixed kernel and removed its account on 14 May, and a wider audit produced 26 confirmed Savane vulnerabilities (2 critical, 6 high, 16 medium, 2 low), which the FSF fixed. (source: Hacktron)

In a statement dated 19 June 2026, the FSF said all reported issues had been patched and that "we have found no reason to believe that sensitive project data or credentials were accessed, nor that there has been any compromise of Savannah's software supply chain", and that it was taking additional precautionary steps and contacting other Savane instances. (source: Free Software Foundation) iTnews reported the research on 30 October; its article dates the report and the FSF statement to 2025, while Hacktron's timeline and the FSF's own statement give 2026. (source: iTnews)