TL;DR
Get wellness gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published by Disconnect3d on Oct. 2 says a quoted `~` in a shell PATH assignment may not expand to the user’s home directory. The author recommends using `$HOME` and provides a command to check PATH entries for literal tildes.
A shell configuration warning prompted Disconnect3d to report that putting a quoted tilde in a PATH assignment may not add a program directory under the user’s home directory. In a blog post published Oct. 2, the author recommends using $HOME instead, because a literal tilde in PATH can refer to a different, relative directory and affect which executable a shell finds.
The author said the issue came to light while using nono, an agent sandboxing tool, which warned that a PATH entry written as ~/.local/bin/ was writable. The post traces that entry to a common-looking shell configuration line: export PATH="$PATH:~/.local/bin/". Because the tilde is inside quotes, Bash does not expand it in that assignment; the PATH can contain the literal characters ~/.local/bin/ rather than a full home-directory path.
Disconnect3d demonstrated the distinction by creating a directory literally named ~ in the current working directory, placing a test executable beneath it, and running that executable with PATH set to ~/.local/bin/. The example shows the shell finding the program under the relative ./~ directory, not under the user’s home directory. The example is a demonstration of shell behavior, not evidence that a particular user’s machine or account was compromised.
The report recommends replacing the tilde with $HOME, as in export PATH="$PATH:$HOME/.local/bin/". It also offers a check: echo "$PATH" | tr ':' '\n' | grep '~' prints PATH entries containing a tilde. The author notes that an unquoted assignment such as export PATH=$PATH:~/.local/bin can expand in Bash and Zsh, but says relying on that form is fragile, since added whitespace can change how the shell parses the assignment.
How a Literal Tilde Changes Command Lookup
PATH tells a shell where to search for commands. If an entry intended to name a directory in the user’s home instead remains literal, it can point to a directory named ~ relative to the current working directory. The practical effect depends on the shell’s search path and the directories and executables present; the post does not claim that every quoted tilde creates a security incident.
The distinction matters because PATH entries can determine which program runs when someone enters a command. A mistaken entry could make a locally placed executable available from an unexpected location, or simply fail to provide access to the intended programs. The report’s example also shows why a sandbox tool might flag a writable PATH directory: the path’s meaning may not be what its author intended. That warning is a prompt to inspect the entry, not proof of malicious activity.
As an affiliate, we earn on qualifying purchases.
The Shell Rules Behind the Warning
In Bash, tilde expansion applies in specific syntactic positions, including an unquoted tilde at the beginning of a word. The Bash documentation also describes expansion in variable assignments after an equals sign and after a colon in certain cases. Quoting affects whether those rules apply, which is why an assignment that visually includes ~ does not always turn it into a home-directory path.
The post focuses on PATH entries added in shell startup files such as .bashrc, .zshrc and .profile. It identifies $HOME as the more explicit form for this configuration. Disconnect3d also credits nono for raising the warning, while saying the warning could explain the issue more fully and that a pull request was planned.
“Instead of having /home/
/.local/bin/ added to PATH we end up with ./~/.local/bin/ added to PATH.” — Disconnect3d, in the blog post
As an affiliate, we earn on qualifying purchases.
What the Report Does Not Establish
The report does not say how many users have this configuration, whether the warning reflects a widespread problem, or whether anyone exploited a PATH entry containing a literal tilde. Its test uses a deliberately created directory and executable to illustrate command lookup. Readers should treat it as a shell-behavior explanation, not a report of a confirmed attack or security breach.
Shell behavior can depend on the exact assignment syntax and shell in use. The post discusses Bash and Zsh and does not establish how every shell or startup-file arrangement handles similar text. A PATH entry containing ~ is a reason to inspect the configuration, but the report does not establish that every such entry is necessarily unsafe or that it has the same effect in every environment.
As an affiliate, we earn on qualifying purchases.
Check Startup Files and PATH Entries
Users concerned about the issue can inspect their current PATH with the command in the report, then review the shell startup file that adds any matching entry. If the intention is to refer to a directory under the home directory, Disconnect3d recommends writing $HOME/.local/bin instead of a quoted ~/.local/bin. After changing a startup file, users can start a new shell or reload the file and check PATH again.
The source says the author planned to submit a pull request to make nono’s warning more verbose. It does not confirm whether that change was submitted, accepted or released. No further tool update or broader investigation is specified in the report.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does a tilde in PATH always mean there is a problem?
No. The report says a quoted tilde in a PATH assignment may remain literal. Its effect depends on how the entry was created and the shell’s parsing rules, so inspect the entry and intended directory rather than assuming every tilde signals an incident.
What should I use instead of a quoted tilde?
For a directory under your home directory, the author recommends $HOME, for example export PATH="$PATH:$HOME/.local/bin/".
How can I check whether PATH contains a tilde?
Run echo "$PATH" | tr ':' '\n' | grep '~' to print PATH entries that contain a tilde. A match does not by itself establish a security issue; check what directory the entry refers to.
Does the example prove that a system was compromised?
No. The blog post creates a test directory literally named ~ and runs a test executable from it to show how command lookup can work. It reports no confirmed compromise or exploitation.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
