Any CGI script which was written in bash, that's the worry. Since mod_cgi uses environment variables to pass along HTTP headers, those programs are sure to touch the environment.

Even if the CGI script is in some other language, think of how many .sh wrapper scripts there are out there.

EDIT: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-b... explains it better