[dylukes]

zsh is also vulnerable. (it's a bash derivative)

[brians]

Can you show example code exploiting zsh? I haven't seen such, nor found such:

  » V='() { :; }; echo busted' zsh -c "echo hi"
  hi

But:

  » V='() { :; }; echo busted' bash -c "echo hi"
  busted
  hi

[Glan1984]

https://security.stackexchange.com/questions/68146/how-do-i-...

[bodyfour]

That's incorrect; it does not appear to have the "export function" feature that this bug relies on.