The cursor blinked twice, and the terminal waited. You hit Tab—and it gave you more than you asked for. That’s the moment privilege escalation hides inside tab completion.
Privilege escalation via tab completion happens when shell environments, CLI tools, or custom autocomplete scripts expose commands, paths, or files that a lower-privilege user should never see or use. The autocomplete logic reads from system directories or executes lookups with elevated permissions, revealing sensitive binaries or configuration files. From there, exploitation is a matter of selecting the right entry and running with an inherited privilege level.
In Bash, Zsh, and other shells, tab completion is often customized with functions and plugins. These run code silently when you press Tab. If that code executes with higher privileges—or uses cached results from privileged contexts—it can bypass normal security checks. Attackers know this. They look for completion scripts that touch /etc, restricted home directories, or privileged APIs. A poorly confined autocomplete function can open a direct path to root.
Secure implementations limit tab completion scope, enforce user-based permissions at every call, and avoid privileged path discovery entirely. Least privilege must apply even to helper utilities. Auditing completion scripts for unsafe paths, ambiguous command expansions, and unprotected variable handling is critical.