A list names shell variables that can hijack a startup, with no visible consumer.
The denylist exists; whether Bash handling filters them is not visible.
What's wrong with this entry?
A standalone list of shell-sensitive environment variables now exists, covering ENV, BASH_ENV, SHELLOPTS, PS4, GLOBIGNORE, LOCPATH, IFS, TMPDIR, BASH_LOADABLES_PATH and others, the kind that can hijack a shell at startup. Whether Bash command handling filters them is not visible from the constant alone.
BASH_LOADABLES_PATH
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.236
macOS sandbox re-applies read and delete denials inside writable folders
Both mention sandbox
-
v2.1.236
Sandbox proxy no longer writes to sockets that have gone away
Both mention sandbox
-
v2.1.236
IPv6 hosts through the proxy
Both mention sandbox