Word splitting is shell behavior that breaks a piece of text into separate command-line arguments, usually on spaces, tabs, and newlines. In Bash and similar shells, this often happens when variables are expanded without quotes. For example, a filename or user-supplied string can turn into multiple arguments, or even into unexpected options, if it contains whitespace or shell metacharacters.
In cyber security, word splitting matters because it can turn ordinary automation into a reliability or security problem. Attackers may abuse unquoted input to alter how a script processes files, commands, or paths, while defenders look for it in audits of backup jobs, cleanup scripts, and incident-response tooling. Safer patterns include quoting variables, using arrays, reading data with NUL delimiters when possible, and validating input before it reaches the shell.