uname lead to embed code execution

[felix]

There it is:

$ declare -A map; key='foo$(uname >/dev/tty)bar'; map[$key]=
$ echo map["$key"]
map[foo$(uname >/dev/tty)bar]
$ echo ${map["$key"]}

$ unset map["$key"]
Linux

Or even:

$ declare -A map; key='foo$(read -t 3 </dev/tty foo;echo >/dev/tty bar: 
$foo)bar'; map[$key]=
...
$ unset map["$key"]
baz  # hitted in  3 seconds
bar: baz

-- 
 Félix Hauri