Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk3 min

SC2086: How an Unquoted Shell Expansion Can Make `rm` Target Unnamed Files

An unquoted expansion can change the arguments a command receives. Learn why SC2086 flags the risk and how to keep single values and argument lists intact.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

An unquoted shell expansion can turn one variable reference into several command-line arguments. Shell splitting and filename expansion may change both how many arguments a command receives and what those arguments name. For a single pathname, quote the expansion; for an intentional list of arguments, store and pass the arguments separately.

One terminology note: ShellCheck’s severity scale includes error, warning, info and style, and a recent diagnostic example labels SC2086 as info. So the title’s “lowest-severity warning” is a useful hook, but SC2086 is commonly shown at the info level, below warning on that scale. ShellCheck’s manual lists the levels; a 2026 issue reproduces the SC2086 label.

As an Amazon Associate I earn from qualifying purchases.

What SC2086 is warning about

ShellCheck’s diagnostic says: “Double quote to prevent globbing and word splitting.” SC2086’s documentation is about what the shell does to an unquoted expansion before it runs the command.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Consider a command such as rm $target. If $target expands to text containing separators, the shell may split that text into separate words according to IFS. It may then treat words containing glob characters such as * as filename patterns and replace them with matching names in the current directory. The command receives the resulting arguments—not necessarily the single pathname the script’s source line seems to imply.

In an rm scenario, that means a variable whose value contains separators and a glob pattern can lead to multiple path arguments. If matching files are among them, rm can act on files the script never named literally. This describes how the shell can transform arguments; it does not verify any particular two-file deletion incident.

Quote a scalar value to keep it intact

If a variable represents one pathname or other single value, quote its expansion so spaces, newlines and glob characters remain data rather than triggering splitting or filename expansion:

rm -- "$target"

The key SC2086 remedy illustrated here is "$target". The -- shown is a familiar way to mark the end of options for commands that support it; check the command’s own behavior and portability requirements before relying on it.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

ShellCheck’s minimal example is echo $1: although it may look like it prints one argument, an unquoted expansion can split and glob-expand its value. Its suggested form is echo "$1".

Pass a list as separate arguments, not as a space-separated string

Quoting is not a general way to turn text containing spaces into several arguments. If a string such as "-l -a" is quoted, the shell passes it as one argument. When a command needs several options or values, represent them as separate arguments and preserve their boundaries.

Approach Best fit Portability and argument handling
Bash array, expanded as "${args[@]}" A list of arguments in Bash or another shell with array support Keeps each array element as a separate argument, including values containing spaces or glob characters. The SC2086 guide names Bash, ksh and zsh as supporting arrays.
Positional parameters passed as "$@", often through a function A list of arguments in POSIX shell Preserves the separate positional parameters without relying on shell arrays. The guide demonstrates setting them with set -- and passing them with "$@".

Bash: use an array for a list

Store each argument as its own array element, then expand the elements with "${args[@]}":

args=(--name "value with spaces" "*.txt")
command "${args[@]}"

The quoted array expansion preserves each element as one argument. A glob character inside an element stays literal rather than expanding to matching filenames.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

POSIX shell: use positional parameters

In POSIX shell code, positional parameters can hold a list of arguments. Pass them with "$@", including when calling a function:

run_command() {
    command "$@"
}

set -- --name "value with spaces" "*.txt"
run_command "$@"

Here, set -- assigns separate positional parameters, and each "$@" passes them through without merging them into one string.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Why changing IFS or disabling globbing is not the usual fix

ShellCheck’s guide describes changing IFS or using set -f to control splitting or globbing for particular intentional-splitting tasks. Those controls change shell behavior; they do not make a space-separated string a reliably structured list. For ordinary command construction, use a quoted scalar for one value or arrays or positional parameters for multiple values.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.