TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published by Disconnect3d on Oct. 2 explains that putting `~` inside a quoted PATH assignment can leave it as a literal character rather than expand it to the home directory. The author recommends using `$HOME` and gives a command to check PATH for entries containing a tilde.
A warning from the nono sandboxing tool prompted developer Disconnect3d to report that a common PATH setting can point somewhere other than a user’s home directory. In shell startup files, the quoted assignment `export PATH=”$PATH:~/.local/bin/”` may leave the tilde literal, rather than expanding it to `$HOME`; the author recommends writing `$HOME/.local/bin/` instead.
Disconnect3d said nono warned that a PATH entry it could write to was `~/.local/bin/`, which looked suspicious. The author traced the warning to how shells handle tilde expansion: a tilde at the start of an unquoted word can expand to a home directory, but the tilde in the quoted PATH assignment is not in that position. The report cites Bash’s documentation on expansion rules.
If the tilde stays literal, the PATH entry names a relative directory called `~/.local/bin/` beneath the current working directory. It does not identify the user’s home directory. Disconnect3d demonstrated that a program placed in such a directory could be found and run when PATH was set to that literal entry, showing the distinction with a local example.
The suggested fix is to use `export PATH=”$PATH:$HOME/.local/bin/”`. The report notes that the unquoted form with a tilde can work in Bash and Zsh, but says it is more fragile, including because whitespace can affect assignment parsing. It also provides a quick check: `echo “$PATH” | grep — ‘~’`. Any output indicates a PATH entry containing a tilde that merits review, not proof by itself that the user’s configuration is wrong.
A PATH Entry Can Point Elsewhere
PATH tells a shell where to search for executable programs. A mistaken entry can make a command resolve from an unexpected directory, including a directory relative to the current location rather than the user’s home. That can cause confusing command lookup behavior and, depending on the directory and its contents, could create a security concern if an unintended executable is run.
The report does not establish that every tilde-containing PATH value is unsafe or that the sandbox warning reflects an exploited vulnerability. Its practical point is narrower: quoted `~` may not expand, so users should inspect the actual PATH value and use `$HOME` for an explicit home-directory reference.
As an affiliate, we earn on qualifying purchases.
How Shell Expansion Applies
The report appeared on Disconnect3d’s blog on Oct. 2, 2026, after the author encountered the warning while testing nono, a tool for sandboxing agents. The author then examined a shell configuration pattern often used to add a personal program directory to PATH.
Bash’s documented rules distinguish an unquoted tilde-prefix from a tilde inside quoted text. The report also says Bash and Zsh expand a tilde in certain unquoted variable assignments after `=` and after `:`, which explains why removing the quotes may appear to fix the example. Disconnect3d favors `$HOME` as the clearer and less fragile form.
““Instead of having /home/
/.local/bin/ added to PATH we end up with ./~/.local/bin/ added to PATH.”” — Disconnect3d, in the blog report
What the Warning Does Not Show
The report gives a shell-behavior explanation and a demonstration, but it does not say how many users or configurations are affected. It also does not establish that every PATH entry containing `~` is erroneous: the meaning depends on the shell, how the value was assigned, and the actual directory layout. The grep check is a way to find entries for inspection, not a complete diagnosis.
The blog says a pull request to make nono’s warning more verbose was forthcoming. The source does not report whether that change was submitted, merged, or released, nor does it describe a security incident tied to the issue.
Review PATH and Shell Settings
Users who find a tilde in PATH can inspect the relevant startup file—such as `.bashrc`, `.zshrc` or `.profile`—and check how the entry is quoted and expanded. Where the intent is to refer to the home directory, the report recommends replacing `~` with `$HOME`, then opening a new shell or reloading the configuration and checking PATH again.
Disconnect3d said a more detailed nono warning was planned through a pull request, but no later status is provided in the report. Whether that change is available remains unconfirmed by the cited source.
Key Questions
Does `~` always expand to my home directory in PATH?
No. In the quoted assignment shown in the report, the tilde may remain literal. Expansion depends on the shell’s rules and the assignment’s quoting and form.
What should I use for my home directory in PATH?
Disconnect3d recommends `$HOME`, as in `export PATH=”$PATH:$HOME/.local/bin/”`.
How can I check whether PATH contains a tilde?
The report suggests `echo “$PATH” | grep — ‘~’`. To display entries separately, use `echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’`. A match should be inspected; it does not by itself prove the entry is misconfigured.
Does a tilde in PATH mean my system has been compromised?
No such conclusion follows from the report. It describes a possible path configuration mistake and a sandbox warning, not a confirmed compromise or attack.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
