TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published by Disconnect3d on October 2 explains that putting a quoted tilde path such as “~/.local/bin” into PATH does not expand it to the home directory in Bash or Zsh. The entry can instead refer to a literal ./~ directory, so the report recommends using “$HOME/.local/bin” and checking PATH for tilde characters.
A warning from the nono agent sandboxing tool prompted developer Disconnect3d to report that a quoted tilde in a shell PATH entry may remain literal, rather than resolving to the user’s home directory. In configurations such as export PATH="$PATH:~/.local/bin/", that can leave a relative ./~/.local/bin/ directory in PATH instead of the intended $HOME/.local/bin.
Disconnect3d’s report, published October 2, says nono flagged ~/.local/bin/ as a PATH entry the sandbox could write to. The author traced the warning to a common-looking configuration line in a .bashrc or .zshrc file: when the tilde is inside double quotes, the shell does not perform the usual tilde expansion that turns ~ into a home-directory path.
The distinction can change where a command is found. If a literal directory named ~ exists in the current working directory and contains the requested executable, a PATH entry that starts with ~ can lead the shell to run that file. Disconnect3d demonstrated this by creating a program under ./~/.local/bin/ and showing that a command lookup using PATH="~/.local/bin/" ran it. In that demonstration, the home directory was not involved.
The report recommends replacing the tilde with the explicit variable: export PATH="$PATH:$HOME/.local/bin/". It also gives two quick checks: echo "$PATH" | grep -- '~' to search the full value, or echo "$PATH" | tr ':' '\n' | grep '~' to inspect matching entries one per line. A match is a prompt to review the shell configuration; it does not by itself prove that a command has been misdirected or that a system has been compromised.
How a PATH Entry Can Mislead
PATH tells a shell where to search when a user runs a command without specifying its full location. A mistaken entry can make the shell search a different directory from the one the user intended. That matters most when the literal ./~ directory exists and contains a program with a name the user runs: the shell may find that executable through the relative PATH entry.
Disconnect3d’s example illustrates a command lookup risk, not evidence that this behavior has caused a real-world attack. The report’s immediate practical point is that developers should verify what their configured PATH contains, especially when copying or editing shell startup commands. Using $HOME makes the intended directory explicit and avoids depending on tilde expansion rules.
shell scripting home directory tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Shell Expansion Rule at Issue
The report cites Bash documentation describing when tilde expansion occurs. Bash expands a tilde-prefix in an unquoted word, and its rules also cover certain unquoted tilde prefixes in variable assignments, including after a colon. Those exceptions explain why a line such as export PATH=$PATH:~/.local/bin can work in Bash and Zsh even though the tilde appears in an assignment.
That behavior is different from placing the value in double quotes. In export PATH="$PATH:~/.local/bin", the tilde is quoted, so the shell does not expand it. The author cautions that relying on the unquoted form is fragile: introducing whitespace can affect how the assignment is parsed. The suggested $HOME form avoids that particular ambiguity.
The report arose from a warning by nono, a tool for sandboxing agents, and Disconnect3d says the warning could have explained the issue more clearly. The author said a pull request was forthcoming; the report does not establish whether that proposed change was later submitted or merged.
“the tilde in your PATH may not be your HOME”
— Disconnect3d, in the October 2 report
Linux PATH configuration utilities
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What a Tilde Match Cannot Prove
A tilde found in PATH does not establish that a literal ./~ directory exists, that a command has been run from it, or that a system has been affected. The effect depends on the PATH value, shell behavior, working directory and whether a matching executable is present. The report demonstrates one configuration and execution; it does not provide evidence about how widespread the mistake is.
It is also unclear from the report whether nono issued the warning because of this precise expansion issue in every environment, or whether the tool’s warning covers a broader set of writable PATH entries. Disconnect3d said a pull request was planned to make the warning more informative, but the report does not give its later status.
bash zsh shell environment variables
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Review Startup Files and Tool Warning
Readers who find a tilde in PATH can inspect the relevant .bashrc, .zshrc or .profile entry and decide whether it was intended to point to the home directory. If so, the report recommends using $HOME in place of ~, then opening a new shell or otherwise reloading the configuration and checking the resulting PATH.
Disconnect3d said a pull request was forthcoming to improve nono’s warning, but no outcome for that work is stated in the source report. Until further details are available, the practical takeaway remains to distinguish literal PATH text from the expanded directory it is meant to represent.
command line PATH management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does a tilde in PATH always mean the home directory?
No. In the quoted example "~/.local/bin", the tilde is not expanded and may be treated as part of a literal relative path.
What should I use for a home-directory PATH entry?
Disconnect3d recommends using $HOME, as in export PATH="$PATH:$HOME/.local/bin/".
How can I check whether PATH contains a tilde?
Search with echo "$PATH" | grep -- '~'. To print PATH entries on separate lines before searching, use echo "$PATH" | tr ':' '\n' | grep '~'.
Does finding a tilde prove a security problem?
No. It identifies an entry that may need review. Whether a command is found in an unintended directory depends on the actual PATH, the working directory and the files present there.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
