[PhilipRoman]

This is completely safe: [ "${payload}" -eq 42 ]

This can evaluate arbitrary code: [[ "${payload}" -eq 42 ]]

Here is one example of a malicious payload:

  payload='a[$(touch /tmp/pwned)]'

[ndsipa_pomu]

Thanks.

Now I need to figure out whether (( payload == 42 )) is safe.

[ndsipa_pomu]

It appears not.