Are you referring to the BaSH vulnerability that has to do with how SHELLOPTS and PS4 environment variables were processed for executables that had setuid? That was an issue, SETUID should not be set for certain programs in the first place, anyway there's a patch for that. How does writing a shell in Rust or any other language for that matter guard against this?