A webserver doesn't have to interact with bash directly or otherwise for a system to be vulnerable to this bug. Here's one scenario: 1. A webserver may set e

A webserver doesn't have to interact with bash directly or otherwise for a system to be vulnerable to this bug. Here's one scenario: 1. A webserver may set environment variables passed to it from a URL perhaps. 2. Malicious users could craft a URL that set environment variables containing bash commands that do nefarious things. 3. The next time bash is launched (either by a human or programmatically) those nefarious commands are executed perhaps with root privileges.