Why do you think it's called shellshock? If you know enough about Unix and you find out what this bug is all about, that's what happens to you immediately. It's bad; I really don't write about bugs, they get fixed, no big deal.
But this has me looking at the sources - to me this one looks massive to the point of ubiquity and I think some of the fundamental assumptions are, how can I put this kindly, "off the fucking rails" and IMO show a lack of thought in the current CGI interface.
I don't think there's a way to fix this safely. It's like trying to find a safe way to transport an open container of gasoline with four chain-smokers. That's just not going to happen.