Anything that allows user-input to end up in an environment variable, that later makes any[0] call to Bash (even with the Bash command user-sanitized), will trigger this.

[0] With the caveat that it's possible to limit the inherited environment variables, but this is rarely done, and even things like $PATH could be potential vectors depending on the code.