TL;DR
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
A report published by Disconnect3d on October 2, 2026, explains that a quoted tilde in a PATH assignment may not expand to the home directory. The suggested fix is to use $HOME, and a grep command can help identify PATH entries containing a literal tilde.
A warning from the nono agent sandboxing tool prompted developer Disconnect3d to report that a quoted tilde in PATH may be treated as a literal character rather than expanded to the user’s home directory. The issue can leave a relative directory such as ./~/.local/bin/ in the command search path, potentially making a shell run a program from an unintended location.
Disconnect3d’s report says the warning appeared while testing nono and identified ~/.local/bin/ as a PATH entry the sandbox could write to. The author traced the problem to shell configuration written as export PATH=”$PATH:~/.local/bin/”. Because the tilde is inside double quotes, the expected home-directory expansion does not occur in this example.
The report recommends replacing the tilde with the $HOME variable: export PATH=”$PATH:$HOME/.local/bin/”. It also notes that an unquoted assignment such as export PATH=$PATH:~/.local/bin works in Bash and Zsh under the expansion rules described in the post, but calls that approach fragile: changes such as adding whitespace can affect how the shell parses an assignment.
To demonstrate the consequence, Disconnect3d describes creating a directory literally named ./~/.local/bin/, placing a test executable there and running it with a PATH set to ~/.local/bin/. The shell found and executed the program from that relative directory. The example shows that a command can appear to work while searching somewhere other than the user’s home directory.
How a Literal Tilde Changes Command Lookup
PATH controls where a shell looks when a command is entered without a full path. If a PATH entry contains a literal tilde rather than the intended home-directory path, commands may be found in an unexpected location. In the report’s example, a program stored under a directory named ./~ ran successfully, which could make the misconfiguration less obvious.
The warning also has a security relevance: nono flagged the directory as writable by the sandbox. The post does not claim that the issue caused an attack or that a particular system was compromised. It illustrates why administrators and users should check whether PATH points to the directories they intended, especially when tools assess writable command locations.
For readers, the practical step is limited and clear: inspect their shell’s configured PATH, and use $HOME rather than a quoted tilde when adding a home-directory location. Whether a mistaken entry creates an actual security risk depends on the surrounding environment, which the report does not assess.
As an affiliate, we earn on qualifying purchases.
The Shell Expansion Behind the Warning
Shells can expand a leading, unquoted tilde in certain circumstances, but quoting changes the rules. Disconnect3d cites the Bash documentation, which says tilde expansion applies to an unquoted tilde-prefix and can also occur in variable assignments after an equals sign or after a colon. That behavior explains why an unquoted PATH assignment can work while a quoted tilde in the example does not.
The report focuses on Bash and Zsh and on a specific form of PATH configuration in shell startup files such as .bashrc, .zshrc and .profile. It does not offer a survey of every shell, operating system or possible PATH syntax. Its immediate trigger was the nono warning; Disconnect3d said the warning could give more detail and mentioned that a pull request was forthcoming.
“The tilde in your PATH may not be your HOME.”
— Disconnect3d, in the October 2, 2026 report
As an affiliate, we earn on qualifying purchases.
Scope and Security Effects Still Unclear
The report documents a specific shell configuration and an illustrative test, but does not establish how commonly the mistake occurs or how many users are affected. It also does not report an exploit, compromise or measured security impact. Those questions should not be inferred from the example alone.
The author’s discussion names Bash and Zsh, while the report does not test other shells or every possible quoting and assignment pattern. It is also unclear from the post whether the proposed nono warning change was submitted or released; the author described a pull request as forthcoming.
As an affiliate, we earn on qualifying purchases.
Check PATH and Follow the Tool Update
Users who want to check their current PATH can run echo “$PATH” | grep — ‘~’. To display individual entries, the report suggests echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’. A match identifies an entry containing a tilde; it does not by itself prove that the entry is wrong, so users should inspect the relevant shell startup file and confirm the intended directory.
Where the intent is to add a directory beneath the home folder, Disconnect3d recommends changing the configuration to use $HOME, then starting a new shell or reloading the relevant configuration. The report also points to a possible future nono warning improvement, but gives no release date or confirmation that a change has shipped.
command line path management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does a tilde in PATH mean?
It is a character in a PATH entry. Whether it stands for the user’s home directory depends on how the shell parses and expands that entry; in the quoted example in the report, it remains literal.
What should I use instead of a quoted tilde?
For a home-directory path in the configuration described, Disconnect3d recommends $HOME, as in export PATH=”$PATH:$HOME/.local/bin/”.
How can I check for a tilde in my current PATH?
Run echo “$PATH” | grep — ‘~’ to search the full value, or split it into entries with echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’. A match should be checked against the intended configuration.
Does this mean my computer has been compromised?
No such compromise is reported. The post demonstrates a PATH configuration mistake and explains a potential concern when a sandbox can write to a listed location, but it does not document an attack or establish that affected systems were breached.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
