You're missing the point. Look at this code. export evil='() { :;}; exit'; echo $evil # prints '() { :;}; exit' bash # new bash session immediately ex

You're missing the point. Look at this code. export evil='() { :;}; exit'; echo $evil # prints '() { :;}; exit' bash # new bash session immediately exits Imagine a dev using eval() in PHP. The PHP interpreter creates a new environment, executes your (presumably sanitized) code, but also automatically calls eval on every global variable in your app. That would be a huge bug in PHP, and it's the equivalent of what bash is doing.