The Tilde In Your PATH May Not Be Your HOME

TL;DR

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

A report published by Disconnect3d on Oct. 2 describes how quoting a PATH assignment can leave `~` unexpanded, so a path intended to refer to the home directory may instead point to a literal `~` directory. The author recommends using `$HOME` and provides a command to check PATH entries for a tilde.

A report published by developer Disconnect3d on Oct. 2 warns that putting a quoted tilde path such as `~/.local/bin/` into a shell’s PATH can leave the tilde unexpanded, directing command searches to a literal `~` directory instead of the user’s home folder. The author recommends using `$HOME` in shell configuration files and says a simple check can reveal PATH entries that still contain a tilde.

The issue arises in assignments such as `export PATH=”$PATH:~/.local/bin/”` in `.bashrc` or `.zshrc`. Disconnect3d explains that Bash performs tilde expansion in certain assignment contexts when the tilde is unquoted, but the quoted example prevents that expansion. The resulting PATH can contain the literal string `~/.local/bin/`, rather than an absolute path under the user’s home directory.

That distinction affects where the shell looks for executable commands. In the report’s demonstration, the author creates a directory named `./~/.local/bin/`, puts a test program there, then sets PATH to `~/.local/bin/`. Running the program succeeds from that relative directory. The example shows that finding and running a command does not prove the tilde resolved to HOME.

Disconnect3d recommends writing `export PATH=”$PATH:$HOME/.local/bin/”` instead. The post also notes that an unquoted assignment such as `export PATH=$PATH:~/.local/bin` works in Bash and Zsh under the described rules, but calls that approach fragile because whitespace can disrupt the assignment. The author’s check is `echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’`, which prints entries containing a tilde.

A PATH Entry Can Point Elsewhere

PATH tells a shell which directories to search when a user runs a command by name. If a configuration entry contains a literal tilde, a command may be found in an unintended directory, or the expected executable in the home directory may not be found. The post’s example establishes that a relative directory named `~` can be used as a source for a command; it does not show that every affected setup will contain such a directory or run an unintended program.

The warning is relevant to people who maintain shell startup files or rely on personal executable directories such as `.local/bin`. Reviewing the entry helps users confirm that their PATH points where they intended. The author says the issue was brought to attention by a warning from nono, an agent sandboxing tool, which identified a PATH entry the sandbox could write to. That prompted the investigation, though the post does not report a broader security incident.

How Quoting Changes Tilde Expansion

The report focuses on shell parsing rules, not a change in Bash or Zsh. Bash documentation, as quoted by Disconnect3d, describes tilde expansion for an unquoted tilde-prefix at the beginning of a word, and in certain variable-assignment positions, including after a colon. Those rules explain why an unquoted tilde in a PATH assignment can expand while the quoted example does not.

Using `$HOME` makes the intended home-directory reference explicit in the quoted assignment. Disconnect3d’s post describes the behavior in Bash and Zsh and advises readers to inspect `.bashrc`, `.zshrc` or `.profile` for the problematic form. It does not provide a survey of how often the mistake occurs or establish that all shells handle assignments identically.

““So instead of having /home//.local/bin/ added to PATH we end up with ./~/.local/bin/ added to PATH.””

— Disconnect3d, in the Oct. 2 report

Scope Beyond the Demonstration

The report does not quantify how many users have this configuration, test every shell or operating system, or describe the behavior of other shell implementations. Its demonstration shows a specific outcome for the examples discussed, while the exact result in any reader’s environment depends on their shell, PATH value and directory layout. The post also does not say whether nono has changed its warning or whether the planned contribution to the tool has been merged.

Check Startup Files and PATH

Readers can run the suggested check to print PATH entries that contain `~`, then inspect the relevant shell startup files and replace an affected tilde reference with `$HOME`. The check identifies matching text; it does not itself determine whether a particular entry is harmful or whether it came from a startup file. Disconnect3d says a contribution to make nono’s warning more verbose is forthcoming, but the report gives no release date or confirmation that the change has shipped.

Key Questions

Why might `~` in PATH fail to mean my home directory?

In the quoted assignment shown in the report, the tilde is not expanded. The PATH entry can therefore retain the literal `~` instead of becoming a path under $HOME.

What should I use instead of `~` in a quoted PATH assignment?

Disconnect3d recommends using `$HOME`, as in `export PATH=”$PATH:$HOME/.local/bin/”`.

How can I check for tilde characters in PATH?

Run `echo “$PATH” | tr ‘:’ ‘\n’ | grep ‘~’` to print PATH entries containing a tilde. Then review the entries and the shell startup files that set them.

Does finding a command prove the tilde expanded correctly?

No. The report demonstrates a command running from a directory literally named `~`. A successful command lookup alone does not confirm that the shell searched the intended home-directory path.

Source: hn