Which vulnerability is an example of Shellshock?

SQL injection targets unsanitized input passed into database queries to manipulate SQL statements, which is unrelated to the Bash environment variable parsing flaw exploited by Shellshock.

A heap overflow corrupts dynamically allocated memory to redirect program execution flow, a fundamentally different vulnerability class from the string parsing bug in Bash that Shellshock exploits.

Cross-site scripting (XSS) injects malicious client-side scripts into web pages to attack browser users, which is a web application vulnerability entirely unrelated to the server-side Bash shell parsing issue.

Shellshock exploits a flaw in how GNU Bash parses function definitions stored in environment variables - an attacker can append arbitrary commands after the function definition and Bash will execute them, which is precisely command injection; this affected web servers using CGI, DHCP clients, SSH, and any service that invoked Bash with attacker-controlled environment variables.