Maybe a small note, but the variable needs to start with the bytes "() {", not the characters. For example, () {̀ also triggers the parsing code. That's a `

Maybe a small note, but the variable needs to start with the bytes "() {", not the characters. For example, () {̀ also triggers the parsing code. That's a ` over the { using Unicode. FWIW, I haven't been able to actually exploit it this way, but referencing that variable in the new shell generates errors, so there might be something there: bash: () {̀ :;}; echo vuln2: invalid variable name for name reference