What’s Vulnerable › Vulnerabilities

CVE-1999-0491

• Severity: medium (CVSS 4.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 1999-04-20 · updated 2026-06-16
• Weakness: CWE-94

Description

The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.

Affected products

• GNU Bash: through 2.04; 1.14.0, 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5 (+10)

References

• http://www.securityfocus.com/bid/119
• http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.LNX.4.10.9904202114070.6623-100000%40smooth.Operator.org
• http://www.securityfocus.com/bid/119
• http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.LNX.4.10.9904202114070.6623-100000%40smooth.Operator.org

Get alerted when CVE-1999-0491 or the next vulnerability affects your stack