CVE-1999-1383: GNU Bash

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

(1) bash before 1.14.7, and (2) tcsh 6.05 allow local users to gain privileges via directory names that contain shell metacharacters (` back-tick), which can cause the commands enclosed in the directory name to be executed when the shell expands filenames using the \w option in the PS1 variable.

Affected products

• GNU Bash: up to and including 1.14.6; version 1.14.0 only; version 1.14.1 only; version 1.14.2 only; version 1.14.3 only; version 1.14.4 only; …
• Tcsh Tcsh: version 6.05 only

Published 1996-09-13. Last modified 2026-06-16.