TL;DR
Get wellness gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report by Disconnect3d explains that putting a quoted `~` path in a shell startup file may leave the tilde unexpanded in PATH. In that case, a command can be found in a literal `./~` directory rather than the user’s home directory; using `$HOME` avoids the issue.
A warning from the nono agent sandboxing tool led developer Disconnect3d to report that a quoted tilde in a shell’s PATH setting may remain literal rather than expand to the user’s home directory. The mistake can leave commands searching a directory named ./~/.local/bin instead of the expected $HOME/.local/bin, with implications for which executable a shell runs.
Disconnect3d said nono flagged ~/.local/bin/ as a PATH entry the sandbox could write to. The warning appeared suspicious because the entry was intended to refer to the user’s local bin directory. The report traced the issue to a common-looking startup-file assignment: export PATH=”$PATH:~/.local/bin/”.
In that quoted assignment, the tilde is not expanded to the home directory. The report says the path can instead be interpreted relative to the current directory, as ./~/.local/bin/. Disconnect3d demonstrated that a command placed in that literal directory could still be found and run when PATH was set to “~/.local/bin/”; the example program printed “hello.”
The suggested fix is to use $HOME explicitly: export PATH=”$PATH:$HOME/.local/bin/”. Disconnect3d also noted that an unquoted assignment such as export PATH=$PATH:~/.local/bin works in Bash and Zsh under the described conditions, but called that approach fragile because whitespace can break the assignment.
How a Literal Tilde Can Change Command Lookup
PATH tells a shell which directories to search when a user runs a command without specifying its full location. If a startup file adds the wrong directory, the shell may fail to find a tool installed in the real home-directory bin folder. The demonstration shows a separate risk: if a matching executable exists under a literal ./~ directory, it can be run instead.
That makes the warning relevant to both routine command setup and security checks that inspect writable PATH locations. The report does not establish that this configuration has caused an attack or affected a particular group of users. It identifies a configuration error that can make the actual search path differ from what the person writing it intended.
As an affiliate, we earn on qualifying purchases.
The Shell Expansion Behind the Warning
The report was published on October 2, 2026, on Disconnect3d’s blog, following the warning encountered while using nono. Disconnect3d cited Bash documentation describing tilde expansion for an unquoted tilde-prefix, including cases in variable assignments after an equals sign or colon. That behavior helps explain why an unquoted PATH assignment may work even though the tilde in a quoted string does not.
The distinction is whether the shell treats the tilde as eligible for expansion when it processes the assignment. Quoting the full value protects its contents from some shell interpretation; it does not turn a quoted tilde into the home-directory path. The article’s recommended $HOME form names the intended directory explicitly and avoids relying on tilde expansion in that expression.
““PATH entries the sandbox can write to: ~/.local/bin/””
— Disconnect3d, in the blog report
How Many Setups Are Affected
The report does not estimate how many people have the affected PATH setting, nor does it describe any confirmed compromise or wider incident. The behavior discussed is tied to the shell and the precise quoting and assignment syntax; readers should not assume that every tilde appearing in every PATH display indicates the same underlying problem without checking how the value was created.
The blog describes Bash and Zsh behavior for the examples it gives. It does not provide a survey of other shells, distributions, or startup-file configurations. It also does not report whether nono changed its warning after the author’s planned contribution.
Check Startup Files and PATH Entries
Disconnect3d recommends checking PATH for a literal tilde, either with echo “$PATH” | grep — ‘~’ or by splitting the value at colons and inspecting each entry. The report’s example is echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’. If a suspicious entry appears, users can review the shell startup files they use, including .bashrc, .zshrc, or .profile, and replace the tilde with $HOME where appropriate.
The author also said a pull request was planned to make nono’s warning more verbose. Whether that change was submitted or merged is not established in the report. The immediate step for users is to verify the actual PATH value and correct any entry that does not resolve to the intended directory.
Key Questions
Why might a tilde in PATH fail to point to my home directory?
In the example reported by Disconnect3d, the tilde sits inside a quoted PATH assignment, so it remains a literal ~ rather than expanding to the home directory.
What should I use instead of a quoted tilde?
Use $HOME explicitly, as in export PATH=”$PATH:$HOME/.local/bin/”, after checking that this is the directory you intend to add.
How can I check whether PATH contains a tilde?
Run echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’ to display PATH entries containing a tilde. A match is a prompt to inspect the entry and its source in your shell startup files.
Does this report show that anyone was hacked?
No. Disconnect3d described a shell configuration issue and demonstrated command lookup from a literal ./~/.local/bin directory. The report did not document an attack or a confirmed compromise.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
