It's not setting arbitrary environment variables, it's setting specific ones. Bash is basically calling eval on the list of envvars without re-escaping the val

It's not setting arbitrary environment variables, it's setting specific ones. Bash is basically calling eval on the list of envvars without re-escaping the values. The people who wrote the CGI spec didn't expect that to happen at startup. csh and zsh don't do it, and I can't think of any reason why someone would want that. CGI was always a kludge, and envvars weren't a great choice, but they were presumed to be safe for arbitrary data.