GoKawiilShell tool nono flags a PATH tilde-expansion bug affecting bash and zsh configs
A developer testing the nono agent sandboxing tool received a warning about a writable PATH entry '~/.local/bin/', which led to the discovery that quoted tilde expressions in PATH exports (e.g. export PATH="$PATH:~/.local/bin/") do not expand to the home directory. Instead, bash and zsh interpret the tilde literally, creating a relative directory named './~/.local/bin/' that programs can be tricked into running from. The fix is to use $HOME explicitly instead of a quoted tilde, and users are advised to check their PATH with a grep command for stray tildes.
GoKawiil's interpretation of the reporting above, not reported fact.
This quirk of shell tilde-expansion rules could let an attacker who can write to a current working directory plant a './~/...' folder containing malicious binaries that get executed instead of the intended ones, since quoting is common practice to avoid other shell pitfalls. It suggests many existing .bashrc or .zshrc configurations using quoted tildes may be silently broken or exploitable, even though they appear to work in casual testing. The disclosure highlights how subtle shell syntax rules can create unexpected security gaps in everyday developer environments.
- Quoted tilde expressions in PATH assignments (e.g. "$PATH:~/.local/bin/") do not expand to $HOME in bash and zsh.
- This can cause a literal './~/.local/bin/' directory to be added to PATH, which may be writable and exploitable by attackers.
- Users should replace tilde with $HOME explicitly and check existing PATH entries with a grep command for stray tildes.
Source: disconnect3d.pl, 2026-10-11
Published there as: “The tilde in your PATH may not be your HOME”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.