For Windows devs: remember that some tools and libraries come with bash (and some may not even tell you explicitly).

For instance, msysgit has the vulnerability[1]:

  $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
  vulnerable
  this is a test

[1] from the comments on the blog in the OP