Not a bug. This is a well known issue with restricted mode. You as a sysadmin must provide a very restricted PATH that contains only secure programs. For example, you have to avoid: GNU sed, nvi, vim, ed, emacs, ...
Perhaps this *should* be documented under RESTRICTED SHELL in the bash manual. -- Eduardo Bustamante https://dualbus.me/