$ bash --norc -in <<<'^^&^'
bash-5.2$ ^^&^
Segmentation fault: 11
---
diff --git a/lib/readline/histexpand.c b/lib/readline/histexpand.c
index f2eb18f6..db344b49 100644
--- a/lib/readline/histexpand.c
+++ b/lib/readline/histexpand.c
@@ -730,7 +730,7 @@ history_expand_internal (const char *string, int
start, int qc, int *end_index_p
/* If `&' appears in the rhs, it's supposed to be replaced
with the lhs. */
- if (member ('&', subst_rhs))
+ if (subst_lhs && member ('&', subst_rhs))
postproc_subst_rhs ();
}
else
