diff --git a/README.html b/README.html
index ac3842f..15590ae 100644
--- a/README.html
+++ b/README.html
@@ -178,6 +178,7 @@ It features background tasks and interactive chats, and can serve as an interfac
 <p>Running a Telegram Bot means it is connected to the public and you never know whats send to your Bot.</p>
 <p>Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. Bash programmers often struggle with 'quoting hell' and globbing, see <a href="https://unix.stackexchange.com/questions/171346/security-implications-of-forgetting-to-quote-a-variable-in-bash-posix-shells">Implications of wrong quoting</a></p>
 <p>Whenever you are processing input from from untrusted sources (messages, files, network) you must be as carefull as possible, e.g. set IFS appropriate, disable globbing (set -f) and quote everthing. In addition delete unused scripts and examples from your Bot, e.g. scripts 'notify', 'calc', 'question', and disable all not used commands.</p>
+<p><strong>Note:</strong> Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code execution bug, pls update if you use an older version! One of the most powerful features of unix shells like bash is variable and command substitution, this can lead to RCE and information disclosing bugs if you do not escape '$' porperly, see <a href="https://github.com/topkecleon/telegram-bot-bash/issues/125">Issue #125</a></p>
 <p>A powerful tool to improve your scripts is <code>shellcheck</code>. You can <a href="https://www.shellcheck.net/">use it online</a> or <a href="https://github.com/koalaman/shellcheck#installing">install shellcheck locally</a>. Shellcheck is used extensive in bashbot development to enshure a high code quality, e.g. it's not allowed to push changes without passing all shellcheck tests. In addition bashbot has a <a href="doc/7_develop.md">test suite</a> to check if important functionality is working as expected.</p>
 <h3>Do not use #!/usr/bin/env bash</h3>
 <p><strong>We stay with /bin/bash shebang, because it's more save from security perspective.</strong></p>
@@ -193,6 +194,7 @@ It features background tasks and interactive chats, and can serve as an interfac
 <h2>FAQ</h2>
 <h3>Is this Bot insecure?</h3>
 <p>Bashbot is not more (in)secure as any other Bot written in any other language, we have done our best to make it as secure as possible. But YOU are responsible for the bot commands you wrote and you should know about the risks ...</p>
+<p><strong>Note:</strong> Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code execution bug, pls update if you use an older version!</p>
 <h3>Why Bash and not the much better xyz?</h3>
 <p>Well, thats a damn good question ... may be because I'm an Unix/Linux admin from stone age. Nevertheless there are more reasons from my side:</p>
 <ul>
@@ -228,6 +230,6 @@ It features background tasks and interactive chats, and can serve as an interfac
 <p>@Gnadelwartz</p>
 <h2>That's it!</h2>
 <p>If you feel that there's something missing or if you found a bug, feel free to submit a pull request!</p>
-<h4>$$VERSION$$ v0.96-dev-8-ge63590b</h4>
+<h4>$$VERSION$$ 0.96-dev2-0-gcbad540</h4>
 </body>
 </html>
diff --git a/README.md b/README.md
index 2f9fd2c..6df4f22 100644
--- a/README.md
+++ b/README.md
@@ -197,4 +197,4 @@ This may happen if to many wrong requests are sent to api.telegram.org, e.g. usi
 
 If you feel that there's something missing or if you found a bug, feel free to submit a pull request!
 
-#### $$VERSION$$ v0.96-dev-8-ge63590b
+#### $$VERSION$$ 0.96-dev2-0-gcbad540
diff --git a/README.txt b/README.txt
index 07f8a71..02c6066 100644
--- a/README.txt
+++ b/README.txt
@@ -147,6 +147,13 @@ globbing (set -f) and quote everthing. In addition delete unused scripts and
 examples from your Bot, e.g. scripts 'notify', 'calc', 'question', and disable 
 all not used commands.
 
+**Note:** Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code 
+execution bug, pls update if you use an older version!
+One of the most powerful features of unix shells like bash is variable and 
+command substitution, this can lead to RCE and information disclosing bugs if 
+you do not escape '$' porperly, see [Issue 
+#125](https://github.com/topkecleon/telegram-bot-bash/issues/125)
+
 A powerful tool to improve your scripts is ```shellcheck```. You can [use it 
 online](https://www.shellcheck.net/) or [install shellcheck 
 locally](https://github.com/koalaman/shellcheck#installing). Shellcheck is used 
@@ -200,6 +207,9 @@ Bashbot is not more (in)secure as any other Bot written in any other language,
 we have done our best to make it as secure as possible. But YOU are responsible 
 for the bot commands you wrote and you should know about the risks ...
 
+**Note:** Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code 
+execution bug, pls update if you use an older version!
+
 ### Why Bash and not the much better xyz?
 Well, thats a damn good question ... may be because I'm an Unix/Linux admin 
 from stone age. Nevertheless there are more reasons from my side:
@@ -270,4 +280,4 @@ in 'mycommands.sh' as example.
 If you feel that there's something missing or if you found a bug, feel free to 
 submit a pull request!
 
-#### $$VERSION$$ v0.96-dev-8-ge63590b
+#### $$VERSION$$ 0.96-dev2-0-gcbad540
diff --git a/modules/jsonDB.sh b/modules/jsonDB.sh
index c098fbb..a856261 100644
--- a/modules/jsonDB.sh
+++ b/modules/jsonDB.sh
@@ -5,7 +5,7 @@
 # This file is public domain in the USA and all free countries.
 # Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying)
 #
-#### $$VERSION$$ v0.96-dev-7-g0153928
+#### $$VERSION$$ 0.96-dev2-0-gcbad540
 #
 # source from commands.sh to use jsonDB functions
 #
@@ -63,7 +63,7 @@ if _exists flock; then
 
 	declare -n ARRAY="$1"
 	[ -z "${ARRAY[*]}" ] && return 1
-	declare -A oldARR newARR
+	declare -A oldARR
 
 	# start atomic update here, exclusive max wait 10s
 	{ flock -e -w 10 200
@@ -73,14 +73,14 @@ if _exists flock; then
 		Array2Json "$1" >"${DB}"
 	else
 		# merge arrays
-		local o1 o2 n1 n2
-		o1="$(declare -p oldARR)"; o2="${o1#*\(}"
-		n1="$(declare -p ARRAY)";  n2="${n1#*\(}"
-		unset IFS; set -f
-		#shellcheck disable=SC2034,SC2190,SC2206
-		newARR=( ${o2:0:${#o2}-1} ${n2:0:${#n2}-1} )
-		set +f
-		Array2Json  "newARR" >"${DB}"
+		local key
+set -x
+		for key in "${!ARRAY[@]}"
+		do
+		    oldARR["${key}"]="${ARRAY["${key}"]}"
+		done
+		Array2Json  "oldARR" >"${DB}"
+set +x
 	fi
 	} 200>"${DB}${BASHBOT_LOCKNAME}"
   }