re.match with $ accepted 'host\n'. Use fullmatch and pin the GHSA-mc93-rc3x-fpgq fix with a regression test so the bash -c form cannot return.
Juan Denis