3 ms·

This is immune to the attack: bash -c "$(curl -sSLf $URL)" The key is to download first and then run

• benchaney 8y ago
  Or better yet: curl $URL less $FILE bash $FILE This attack only works at all if you download something and execute it immediately without looking at it.
• arendtio 8y ago
  Do you know if . <(curl -sL $url) works (sourcing from a Process Substitution)?