Potential Security Issue on Code Injection

[nevercodecorrect]

In code here, it eval an environment. A malicious local actor could set some values like export FETSIZE='os.system("touch rickroll")' to execute code.
This issue is similar to CVE-2022-2054.