---
title: Shebang interpreter is not an absolute path
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Shebang interpreter is not an absolute path
---

# Shebang interpreter is not an absolute path

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `bash-security/shebang-non-absolute-path`

**Language:** Bash

**Severity:** Warning

**Category:** Security

**CWE**: [426](https://cwe.mitre.org/data/definitions/426.html)

## Description{% #description %}

A shebang should point to an absolute interpreter path immediately after `#!`. Relative forms such as `#!bash` or `#!bin/sh` are not rooted at `/` and may execute an unintended binary depending on environment configuration.

Prefer explicit absolute paths like `#!/bin/bash`, `#!/usr/bin/bash`, or `#!/bin/sh` to make interpreter selection predictable and reduce path-hijacking risk (CWE-426).

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```bash
#!bin/sh
echo runs via env
```

```bash
#!bash
true
```

## Compliant Code Examples{% #compliant-code-examples %}

```bash
#!/bin/bash
echo ok
```

```bash
#!/usr/bin/bash
true
```

```bash
echo first line is not a shebang
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}