Over the last few hours we began rolling out shellshock fixes to all CoreOS deploys that have automatic updates enabled (this is default). If you have disabled automatic upgrades through cloud-config reboot-strategy, a manual reboot should give you the latest version.
You can test if your CoreOS has been patched by testing the exploit, or by checking the version of CoreOS you are running in
/etc/os-release. Patched versions are listed below: