3 ms·

So ‘curl; cat; bash’ and not ‘curl | sh’ because the server can detect the pace/existence of the pipe and sneak in some unsafe commands.