Rating:

Code execution through arithmetic expansion. See bash-parser documentation for what commands has no name and therefore bypass the check.

Original writeup (https://medium.com/@harryfyx/googlectf-quals-2024-only-echo-97f20db355cc).