Is $PATH hijacking a serious threat vector?

Suppose our hypothetical attacker manages to execute a script on a user who doesn't have admin on their local machine, but has sudo rights on a server. The script installs a malicious ssh wrapper somewhere, doesn't really matter where, and edits the `.env` file to insert it into the path. When the wrapper is run, it installs a similar exploit into the user's remote environment to hijack sudo. The server has effectively been pwned, without needing any form of privilege …

cybersecurity hijacking path serious threat threat vector