Shell script is not a language that was designed with the security of untrusted input in mind, and because shell scripting interpreters are generally used for situations in which a user is at least partly already trusted to run processes on the box, they do not heavily prioritize security or security audits.
When you give a user a system shell account on your server, even if you don't give them root privileges, you are trusting them to some extent not to abuse the system or damage it. Executing code using the same tools from someone on the internet that you don't trust is a recipe for disaster!
Highly publicized vulnerabilities, such as 2014's "ShellShock," resulted largely from abuse of the Bash shell as part of generating responses to requests from the internet. Bash is a system-command interpreter, and was never...