For this to happen the attacker has to control environment variables and then a bash shell is spawned. Lots of web stuff spawn shells setting environment varia

For this to happen the attacker has to control environment variables and then a bash shell is spawned. Lots of web stuff spawn shells setting environment variables to stuff in HTTP headers. LC_TIME with some time zone settings might be one.