Here is a vulnerability in the current version [1] for your amusement: #include <wordexp.h> #include <stdio.h> int main() { wordexp_t we;

Here is a vulnerability in the current version [1] for your amusement: #include <wordexp.h> #include <stdio.h> int main() { wordexp_t we; char *s = "$(($(sleep 10)))"; printf("->%d\n", wordexp(s, &we, WRDE_NOCMD)); } (Since the manual page strongly recommends not trusting wordexp with untrusted input even with WRDE_NOCMD, and based on a code search the function is rarely used in the first place, I don't think it's really sensitive.) http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/FreeBSD/wordexp.c http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/Fr...