> I can’t ever remember seeing a bug in either bash

Shellshock [0] is a rather famous example, but bugs like that are rare enough that they make the news when they're found.

[0] https://en.wikipedia.org/wiki/Shellshock_%28software_bug%29