Right so that enables a potential hacker to set an env variable, which has to in a later step get picked up by another cli tool that uses the env variable in su

Right so that enables a potential hacker to set an env variable, which has to in a later step get picked up by another cli tool that uses the env variable in such a way that the contents of the env variable gets executed as code. So interpreters like node/ruby/perl etc could execute the malicious stuff in the env variables. Are there any other cli tools that could do something dangerous?