The way I see it a sane but unfortunate programmer can cause a CVE, but you have to be insane to do what bash does with its environment. Why the HELL doesn't bash store inherited functions in an environment variable with a known name (e.g. "BASH_INHERITED_FUNCTIONS") like everybody else?!?

In my mind even this trivial example is a bug (albeit less serious from a security perspective):

  $ env VAR="() { This is how I like my VAR } ()" /bin/sh -c 'echo $VAR'
  /bin/sh: VAR: line 0: syntax error near unexpected token `('
  /bin/sh: VAR: line 0: `VAR () { This is how I like my VAR } ()'
  /bin/sh: error importing function definition for `VAR'
  
  $

Imagine an ABI that works like that: you can pass any string, as long as it doesn't start with "() {"... :/