POSIX wordexp(3) can execute shell commands on untrusted input
Original title: POSIX wordexp(3) is dangerous
musl and macOS libc can still treat some patterns as command substitutions even when WRDE_NOCMD is set.
A write-up warns that POSIX wordexp(3), often used for tilde expansion, enables shell command substitution by default. Passing WRDE_NOCMD is incomplete: musl delegates to the system shell after a scan that misses some substitutions, and macOS uses wordexp-helper with a similar bypass reported as of 2023. The author did not retest macOS after its default shell changed from bash to zsh. The advice is not to call wordexp(3) on untrusted input.
Unconfirmed: Whether the macOS bypass still works under zsh was not tested.
- Default flags allow expansions such as $(whoami) and $(cat /etc/passwd).
- musl scans for command substitutions, then shells out and can miss Bash-valid patterns.
- macOS previously shelled out to Perl; wordexp-helper is described as the newer path.
- The 2023 macOS bypass is cited from Julian Squires and was not retested.
Impact: Command execution if untrusted strings reach wordexp
| Product | Affected |
|---|---|
| musl libc wordexp | — |
| Apple macOS libc wordexp | — |
- 1.Do not call wordexp(3) on untrusted input, even with WRDE_NOCMD.
- Vendors
- Apple
- Products
- musl libcmacOS libc
From the original article
1 min read at yossarian.networdexp(3) is a POSIX API for performing shell-style expansions from C. It's often cited/recommended as a way to do tilde expansion (e. g.
By yossarian.net by yossarian · yossarian.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.