No, it's not printed in your trivial example, but if you replace the simple "echo" command with any bash script, or any executable that calls a bash script, or

No, it's not printed in your trivial example, but if you replace the simple "echo" command with any bash script, or any executable that calls a bash script, or any executable that invokes another program that calls a bash script, or ... then you're screwed. Even with the "zsh", this should print "vulnerable": env x='() { :;}; echo vulnerable' zsh -c "bash -c true" You don't have to use bash explicitly. It might be called by some application or library. For example, if your default shell is a bash, this will work too: env x='() { :;}; echo vulnerable' zsh -c "python -c 'import os; os.system(\"true\")'"