It's like a remote execution vulnerability in PHP and Ruby and DHCP and Django and Perl and any of a bunch of different services all layered together.

Environment variables are passed around all the time.