{
  "id": 16489564,
  "title": "POSIX wordexp(3) is dangerous",
  "url": "https://urgent.news/2026/10/25/posix-wordexp-3-is-dangerous",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-25T15:09:29.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://yossarian.net/til/post/posix-wordexp-3-is-dangerous/"
  },
  "original_language": "en",
  "account": "POSIX wordexp(3) is a C API used for shell-style expansions, such as tilde expansion (e.g., converting \"~/foo\" to \"/home/me/foo\"). However, this function can be dangerous when handling untrusted inputs. By default, wordexp(3) enables all expansion features, including command expansion, which can lead to security vulnerabilities.\n\nDisabling command expansion requires passing the WRDE_NOCMD flag. Unfortunately, this workaround may not be effective in all libc implementations. For instance, musl and macOS libc rely on the system shell for wordexp(3) processing, which can result in unexpected behavior. In the case of musl, the issue was still present as late as 2023, while macOS defaulted to zsh instead of bash.\n\nTherefore, it is strongly advised against using wordexp(3) on untrusted inputs, even when employing the WRDE_NOCMD flag. Prior to macOS's shift to zsh, wordexp(3) would delegate to Perl, but the current solution appears to be the wordexp-helper function.",
  "summary": null,
  "key_points": [
    "POSIX wordexp(3) expands shell-style inputs like tilde expansion.",
    "Default settings enable dangerous command expansion in wordexp(3).",
    "Disabling command expansion with WRDENOCMD may not work in all libc implementations."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}