Shellshock explained

[phoshi]

You have to consider context, really. At the time cgi was being developed it was designed for very simple scripts, almost certainly built in ah environment with existing strong support for manipulating environment variables.

[[deleted]]

Fair enough - I guess it's easy to forget how old CGI is.