Not true if the perl script calls out to bash (i.e. via system), as it doesn't sanitize the environment: $ env x='() { :;}; echo vulnerable' perl -T -e "\$

Not true if the perl script calls out to bash (i.e. via system), as it doesn't sanitize the environment: $ env x='() { :;}; echo vulnerable' perl -T -e "\$ENV{PATH} = '/bin'; system('ls | cat');" sh: warning: x: ignoring function definition attempt sh: error importing function definition for `x' ...