TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A report published by Disconnect3d on Oct. 2 describes how quoting a tilde in a shell PATH assignment can stop Bash or Zsh from expanding it to the home directory. The result may be a literal `~` path entry, so commands can be found in a relative directory instead; using `$HOME` avoids the ambiguity.
A shell PATH entry written as `”$PATH:~/.local/bin”` may not point to a user’s home directory: the tilde can remain literal, causing the shell to search a relative directory named `~`. In a report published Oct. 2, developer Disconnect3d described the behavior after the nono sandboxing tool flagged `~/.local/bin/` as a PATH location it could write to.
The issue arises from how shells handle tilde expansion. In the quoted assignment `export PATH=”$PATH:~/.local/bin/”`, the tilde is quoted, so it is not expanded into the home-directory path. Disconnect3d says the PATH can instead contain the literal entry `~/.local/bin/`. When a relative PATH entry is searched, that can resolve as `./~/.local/bin/` from the current working directory, rather than under the user’s home directory.
The report demonstrates the distinction with a small test: it creates a directory named `./~/.local/bin/`, places a compiled program there, and sets PATH to `~/.local/bin/`. Running the program name then succeeds from that directory. The example shows that the home directory was not involved; it does not establish that every system or shell configuration will have such a directory or produce a security incident.
Disconnect3d recommends using `$HOME/.local/bin/` in a quoted assignment, as in `export PATH=”$PATH:$HOME/.local/bin/”`. The author also notes that an unquoted form such as `export PATH=$PATH:~/.local/bin` works in Bash and Zsh because those shells perform tilde expansion in certain assignment positions. The report cautions that this form is more fragile, including because whitespace can disrupt the assignment.
How a PATH Entry Changes Command Lookup
PATH tells a shell where to look for an executable when a command is entered without a directory path. If a user expects `~/.local/bin` to mean a home-directory location but it remains a literal, relative path, the shell may search a different place. That can lead to commands failing to run, or to an executable being found in a directory the user did not intend.
The practical concern depends on the environment. Disconnect3d’s example shows that a program in a relative `./~/.local/bin/` directory can be executed through the malformed PATH entry. The report does not document exploitation or show that a particular system was compromised. It does highlight why users and tools that inspect PATH should distinguish a home-directory path from a literal tilde entry.
Using `$HOME` explicitly makes the intended location clear in a quoted assignment. The report also suggests checking existing PATH values: entries containing a tilde can be a sign to review shell startup files, though the presence of the character alone does not prove how a specific shell or application will interpret the configuration.
As an affiliate, we earn on qualifying purchases.
The Shell Expansion Behind the Warning
The report began when Disconnect3d was testing nono, described as an agent sandboxing tool. It displayed a warning that PATH entries the sandbox could write to included `~/.local/bin/`. That prompted the author to investigate whether the entry actually referred to the home directory.
According to the report, Bash documentation describes tilde expansion for an unquoted tilde at the beginning of a word, and also covers certain positions in variable assignments, including after a colon. Quoting the tilde changes that behavior. The key distinction is not simply whether a path contains `~`, but whether the shell sees it in a position where expansion applies and whether it is quoted.
Disconnect3d suggested a quick check: print PATH and search for a tilde, or split PATH at its colon separators and inspect each entry. The author credited nono for surfacing the issue and said the warning could be more explanatory, adding that a pull request was planned. The report does not say whether that change was later submitted or accepted.
““PATH entries the sandbox can write to: ~/.local/bin/””
— Disconnect3d, in the report
command line PATH management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
When the Tilde Stays Literal
The report documents the behavior in its example and describes the relevant Bash and Zsh assignment forms, but it does not test every shell, operating system, startup-file setup, or process that may read PATH. Users should not assume that every PATH value containing `~` behaves identically across environments.
It is also unknown from the report whether anyone exploited a malformed entry, whether the warning led to changes on other users’ systems, or whether nono’s planned warning improvement was submitted. A tilde found in PATH is a reason to inspect the entry and its source, not by itself evidence of compromise.
home directory environment variable
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Review Startup Files and PATH
Users who suspect the issue can inspect PATH for entries containing `~`, then review the assignment in files such as `.bashrc`, `.zshrc`, or `.profile`. Where the intent is to add a directory under the home directory, the report recommends replacing the tilde in a quoted assignment with `$HOME` and opening a new shell to check the resulting PATH.
Disconnect3d said a pull request to make nono’s warning more verbose was forthcoming, but the report provides no later status. Whether the tool’s warning changes, the practical next step for affected users remains the same: verify what each PATH entry resolves to in the shell and environment where commands run.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does `~` always expand to the home directory in PATH?
No. The report says expansion depends on the shell’s rules and how the tilde is quoted and positioned. In a quoted assignment such as `”$PATH:~/.local/bin”`, it may remain literal.
What should I use instead?
For a quoted assignment, use `$HOME/.local/bin`, for example `export PATH=”$PATH:$HOME/.local/bin”`. This explicitly refers to the home directory variable.
How can I check whether PATH contains a tilde?
Print PATH and inspect it for `~`, or display colon-separated entries on separate lines and search them. Disconnect3d’s report gives `echo “$PATH” | grep — ‘~’` as a quick check and suggests reviewing any matching entry in context.
Does finding `~` in PATH mean my system is compromised?
No. The report describes a configuration pitfall and a test using a deliberately created relative directory. It does not report a compromise. A tilde entry should be checked to see how it resolves and whether it was intended.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
