If you have a bash command line of "exec program ..." and you can control the "..." can you make it not run the exec and do something different? The answer is yes. Even if "..." is somewhat sanitised for shell metacharacters. If you can inject $[+] it will make bash error on that line and run the next. This is how https://dgl.cx/2025/10/bash-a-newline-ssh-proxycommand-cve-2025-61984 works.