oss-security - [vim-security] OS Command Injection in netrw affects Vim

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <aaIPSHOdlpStgkYO@256bit.org>
Date: Fri, 27 Feb 2026 22:40:24 +0100
From: Christian Brabandt <cb@...bit.org>
To: oss-security@...ts.openwall.com
Subject: [vim-security] OS Command Injection in netrw affects Vim < 9.2.0073

OS Command Injection in netrw affects Vim < 9.2.0073
====================================================
Date: 27.02.2026
Severity: Medium
CVE: CVE-2026-28417
CWE: Improper Neutralization of Special Elements used in an OS Command (CWE-78)

### Summary
An OS command injection vulnerability exists in the `netrw` standard plugin
bundled with Vim. By inducing a user to open a crafted URL (e.g., using the
`scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges
of the Vim process.

### Description
When Netrw processes a remote URL (e.g., `scp://hostname/path/`), it parses the
connection string to build shell commands for directory listing and file
transfer.

The vulnerability exists because the `s:NetrwValidateHostname()` function 
originally used an unanchored regular expression that only verified if the 
hostname began with an alphanumeric character. This allowed shell 
metacharacters to be included in the remainder of the hostname string.

A malicious URL can inject and execute arbitrary commands when Netrw invokes
the shell via the `:r!` Ex command.

### Impact
The vulnerability allows for a shell command injection. However, the malicious 
command must be provided as part of a hostname in a URL opened by the user. 
Since such a malformed string is highly likely to be visible and suspicious 
to a user in an interactive context, the severity is rated medium.

### Acknowledgements
The Vim project would like to thank the reporter Github users ehdgks0627 and
un3xploitable for identifying the flaw in hostname parsing and providing the
comprehensive fix for both validation and shell escaping.

### References
The issue has been fixed as of Vim patch [v9.2.0073](https://github.com/vim/vim/releases/tag/v9.2.0073).

[Commit](https://github.com/vim/vim/commit/79348dbbc09332130f4c860)
[Github Advisory](https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336)

Thanks,
Christian
-- 
Ein guter Delphin taucht auch im roten Meer!

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.