TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published by developer Disconnect3d explains that putting a quoted `~` in a PATH assignment may leave it as a literal directory name instead of expanding it to the home directory. The suggested fix is to use `$HOME`, and the report includes commands to check PATH for tilde characters.
A warning from the nono sandboxing tool led developer Disconnect3d to document a shell configuration pitfall: an entry written as `~/.local/bin/` inside quotes may remain a literal tilde path rather than point to the user’s home directory. The report recommends using `$HOME/.local/bin/` in PATH assignments to avoid the ambiguity.
Disconnect3d said the warning identified `~/.local/bin/` as a PATH location the sandbox could write to. The developer traced the issue to a common configuration form, such as `export PATH=”$PATH:~/.local/bin/”` in a Bash or Zsh startup file. In that quoted string, the tilde does not undergo the expected home-directory expansion, according to the report.
The practical consequence is that the PATH entry can refer to a directory literally named `~`, relative to the current working directory, rather than to a user’s home folder. Disconnect3d demonstrated this by creating a program under `./~/.local/bin/` and then running it with that literal directory in PATH. The example showed the program could be found and executed without the home directory being involved.
The report proposes `export PATH=”$PATH:$HOME/.local/bin/”` as the fix. It also notes that an unquoted assignment such as `export PATH=$PATH:~/.local/bin` works in Bash and Zsh because those shells perform tilde expansion in certain assignment positions. The author cautions that relying on this behavior is fragile; whitespace, for example, can disrupt an unquoted assignment.
A PATH Entry Can Point Somewhere Else
PATH tells a shell where to search for executable programs. If a startup file adds the wrong directory, a command may not be found where its user expects, or the shell may instead find a matching executable in a literal `~` directory beneath the current location. That distinction can matter for both reliable command execution and security review.
In the report, the immediate clue came from a sandbox warning about a directory it could write to. A PATH entry that points to an unintended writable location can affect which program is run when a command is entered. The example establishes that a literal tilde directory can be used for command lookup; it does not establish that every quoted-tilde configuration creates a security incident. The concrete recommendation is straightforward: use `$HOME` explicitly and check the resulting PATH.
As an affiliate, we earn on qualifying purchases.
How Shell Tilde Expansion Works
The tilde is a shell feature, not a universal path marker. As the report notes, Bash documentation describes tilde expansion for an unquoted tilde at the start of a word, and in specified positions in variable assignments, including after a colon. Quoting changes how shell characters are interpreted, so a tilde inside a quoted PATH value is not necessarily replaced with the home directory.
This explains why the superficially similar examples behave differently. In `PATH=”$PATH:~/.local/bin/”`, the tilde is within double quotes. In the unquoted assignment `PATH=$PATH:~/.local/bin`, Bash and Zsh can expand it in the assignment. The more explicit `$HOME` form avoids depending on that special-case behavior. Disconnect3d’s post was published on October 2, 2026, after the warning appeared while the author was testing nono.
As an affiliate, we earn on qualifying purchases.
What the Warning Does Not Establish
The report describes a specific shell assignment and an example directory structure; it does not measure how many users or systems are affected. It also does not say that every PATH containing a tilde is necessarily misconfigured: behavior depends on how the value was written and which shell processes it. A tilde that appears literally in PATH is a reason to inspect the configuration, not by itself proof of a security compromise.
The original post says the author intended to submit a change to make nono’s warning more verbose. The source material does not confirm whether that change was merged or released, or whether other shells handle the same forms identically. The report’s examples specifically discuss Bash and Zsh.
As an affiliate, we earn on qualifying purchases.
Check Startup Files and PATH
Disconnect3d suggests checking the current PATH for a tilde with `echo “$PATH” | grep — ‘~’`. To inspect entries individually, the report gives `echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’`. If a result appears, the author advises reviewing shell startup files such as `.bashrc`, `.zshrc` or `.profile`, and replacing an unintended `~` with `$HOME`.
The next step for users is to verify the PATH value after editing the relevant file and starting a new shell. The report also points to a possible follow-up for nono: a more descriptive warning, which the author said was the subject of a planned contribution. No release or merge status for that proposed change was provided.
environment variable management software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the PATH tilde problem?
A quoted tilde in a PATH assignment, such as `”$PATH:~/.local/bin/”`, may stay as the literal character `~` rather than expand to the home directory. The resulting entry can refer to a directory named `~` under the current working directory.
How should I write the home directory in PATH?
The report recommends using `$HOME`, for example: `export PATH=”$PATH:$HOME/.local/bin/”`. This makes the intended home-directory reference explicit.
Does every tilde in PATH mean something is wrong?
Not necessarily. The report says the result depends on how the value was assigned and the shell involved. A tilde found in PATH is a prompt to inspect the startup-file configuration, not proof on its own of a security problem.
How can I check for a tilde in PATH?
Run `echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’` to display PATH entries containing a tilde on separate lines. If one appears, check the relevant shell startup file and confirm whether the entry was intended to be literal.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
