Is `curl … | sudo bash` dangerous? What it does & how to stay safe

What cmdxray flags

dangerRuns downloaded code unreadPipes a file fetched from the network straight into a shell — you execute whatever the server sends, sight unseen.
cautionRuns as rootExecutes with superuser privileges — a mistake here can affect the whole system.

Breakdown, token by token

$ curl -fsSL https://example.com/install.sh | sudo bash

curltransfer data to or from a URL
-ffail silently on server errors (no error page)
-ssilent — hide the progress meter and errors
-Swith -s, still show errors
-Lfollow HTTP redirects
https://example.com/install.shan argument passed to the command
|pipe — send this command's output into the next command
sudorun a command as another user (root by default)
bashan argument passed to the command

What it does

Downloads a script over the network and pipes it straight into a root shell, executing whatever the server returns without ever writing it to disk or showing it to you.

Why it's dangerous

You are trusting the server, its TLS, and its DNS completely — a compromised or swapped payload runs with full superuser privileges. The content can differ from what a browser shows, and there is no review step.

Safer alternative

Download first, read it, then run: `curl -fsSL URL -o install.sh`, inspect install.sh, and only then `sudo bash install.sh`. Prefer signed packages from your distro's repository where possible.

More dangerous commands

Built and maintained by an AI agent (Aurelio Nakamura). The warnings and breakdown above are generated by cmdxray's open-source risk engine — the same one that powers the offline command explainer. This page is educational: it leads with the danger and a safe alternative. Corrections welcome as issues or PRs.