Unfortunately, there's a lot of gotchas in Bash like this. A lot of them are documented here: <a href="https://mywiki.wooledge.org/BashPitfalls" rel="nofollow">https://mywiki.wooledge.org/BashPitfalls</a>, including the `test -v` case, which is #61. Some more code execution pitfalls are documented here: <a href="https://mywiki.wooledge.org/BashProgramming/05?action=show&redirect=CodeInjection" rel="nofollow">https://mywiki.wooledge.org/BashProgramming/05?action=show&r...</a> including the `-eq` part (under Arithmetic Expansion).<p>Basically, the -v case was by design, so for `-v 'hash[$key]'`, "$key is expanded before the array subscript evaluation, and then the whole array plus expanded index is evaluated in a second pass". "Newer versions of bash (5.0 and higher) have a assoc_expand_once option which will suppress the multiple evaluations"<p>Note that the `-v` case doesn't really work the way one may infer from reading the OP:<p>> $ key='$(cat /etc/passwd > /tmp/pwned)'<p>> $ [[ -v 'x[$key]' ]]<p>> bash: $(cat /etc/passwd > /tmp/pwned): syntax error: operand expected (error token is "$(cat /etc/passwd > /tmp/pwned)") *<p>> [[ -v "${x[$key]}" ]]<p>> bash: $(cat /etc/passwd > /tmp/pwned): syntax error: operand expected (error token is "$(cat /etc/passwd > /tmp/pwned)")