CVE-1999-0491: GNU Bash

Medium severity, CVSS 4.6. EPSS: 0.9% chance of exploitation in the next 30 days.

The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.

Affected products

• GNU Bash: up to and including 2.04; version 1.14.0 only; version 1.14.1 only; version 1.14.2 only; version 1.14.3 only; version 1.14.4 only; …

Published 1999-04-20. Last modified 2026-06-16.