TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A report published by Disconnect3d on Oct. 2, 2026, explains that a quoted `~` in a PATH assignment may not expand to the home directory. The suggested fix is to use `$HOME`, then inspect PATH for entries that still contain a tilde.
A warning from the nono agent sandboxing tool led developer Disconnect3d to report that a quoted `~` in a shell PATH assignment may not expand to a user’s home directory. The issue can leave a literal tilde path in PATH, changing which executable runs when a command is entered.
Disconnect3d said the warning identified `~/.local/bin/` as a PATH location the sandbox could write to. The report traces that entry to a common-looking configuration such as `export PATH=”$PATH:~/.local/bin/”` in a `.bashrc` or `.zshrc` file. Because the tilde is quoted, it is not expanded as intended in this form.
The report recommends using `$HOME/.local/bin/` instead: `export PATH=”$PATH:$HOME/.local/bin/”`. Disconnect3d also notes that the unquoted form `export PATH=$PATH:~/.local/bin` works in Bash and Zsh because tilde expansion can occur after `=` and after a colon in an assignment. The post describes relying on that behavior as fragile, including because whitespace can disrupt the assignment.
To check for affected entries, the report suggests running `echo “$PATH” | grep — ‘~’`. To print PATH entries individually before searching, it gives `echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’`. Any output should be checked against shell startup files such as `.bashrc`, `.zshrc` or `.profile`; the report advises replacing the tilde with `$HOME` where appropriate.
How a Literal Tilde Changes PATH
PATH tells a shell where to search for a program when a user enters its name. If an entry intended to point to the home directory instead contains a literal `~`, the shell can search a different location. That can cause a command to be found in an unintended directory, or not to be found where the user expects.
The author’s example shows how the distinction can be easy to miss: a program placed under a directory literally named `~` can still be located and run when that directory appears in PATH. The command works, but it is running from `./~/.local/bin/` rather than the home directory. This matters for users who maintain shell startup files and for sandboxing tools that assess which PATH locations may be writable.
The report does not establish that this issue has caused a security incident or affects every shell configuration. It identifies a configuration pitfall and gives users a way to inspect their own PATH. Using `$HOME` makes the intended home-directory reference explicit in the quoted assignment.
shell scripting environment variable tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Sandbox Warning Behind the Report
Disconnect3d’s post, published on Oct. 2, 2026, describes encountering the warning while testing nono, an agent sandboxing tool. The warning called attention to a PATH entry that appeared to point into a writable location. Investigating it led the author to examine how the tilde was treated in a quoted assignment.
The post cites Bash documentation describing tilde expansion for an unquoted tilde-prefix, including in certain variable assignments following `=` or `:`. Its central distinction is between quoted and unquoted forms: quoting the whole value in the example prevents the expected expansion, while an unquoted assignment may expand the tilde under the described shell behavior. The author’s recommended `$HOME` form avoids depending on that behavior.
To illustrate the result, the report describes creating a directory named `~/.local/bin` relative to the current directory, placing a test executable there, and running it with PATH set to that literal path. The executable ran, demonstrating that a PATH entry containing a tilde need not refer to the user’s home directory.
As an affiliate, we earn on qualifying purchases.
Which Shell Setups Are Affected
The report gives a specific example and discusses Bash and Zsh behavior, but it does not provide a survey of shell versions, configurations or operating systems. The number of users affected is unknown, as is whether the same behavior applies to other shells or to every way PATH can be set.
The post also does not report a confirmed security incident or quantify any practical impact. A PATH entry containing `~` is a reason to inspect the configuration, not by itself proof that a program has been run or that a system has been compromised. Users should check what each entry resolves to and how it entered PATH.
home directory path configuration tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Check Startup Files and PATH
Users who want to check their current environment can run the commands in the report to search PATH for a tilde, then review relevant shell startup files for the assignment that added it. If an entry is meant to point into the home directory, the post recommends replacing `~` with `$HOME` and opening a new shell or reloading the relevant configuration to verify the resulting PATH.
Disconnect3d said a pull request was forthcoming to make the nono warning more verbose. The report did not give a submission or release date, so the status of that change remains unconfirmed.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does a tilde in PATH mean?
It may be a literal tilde rather than a reference to your home directory. In the quoted assignment described by Disconnect3d, `~/.local/bin/` does not expand as intended.
How should I add a home-directory folder to PATH?
The report recommends an explicit variable reference, such as `export PATH=”$PATH:$HOME/.local/bin/”`, so the value points to the home directory.
How can I check whether PATH contains a tilde?
Run `echo “$PATH” | grep — ‘~’`. To display entries on separate lines first, use `echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’`.
Does a tilde in PATH prove my system is compromised?
No. The report describes a path-configuration mistake and a test showing that a program in a literal tilde directory can run. It does not report a confirmed compromise.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
