CVE-2026-28417: 
Vim vulnerability analysis and mitigation

CVE-2026-28417 is an OS command injection vulnerability in the netrw standard plugin bundled with Vim, an open-source command-line text editor. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. All Vim versions prior to 9.2.0073 are affected; version 9.2.0073 fixes the issue. The vulnerability was disclosed on February 27, 2026, by Christian Brabandt via the oss-security mailing list and GitHub Security Advisory GHSA-m3xh-9434-g336. The CVSS v3.1 base score is 7.8 (High) per NVD/Feedly, though the Vim project's own advisory rates it 4.4 (Moderate) (GitHub Advisory, Openwall OSS-Sec).

The root cause is insufficient input validation in the s:NetrwValidateHostname() function within Vim's netrw plugin (CWE-78: OS Command Injection; CWE-86: Improper Neutralization of Invalid Characters in Identifiers). The original function used an unanchored regular expression that only verified whether the hostname began with an alphanumeric character, allowing shell metacharacters (e.g., semicolons, backticks) to appear in the remainder of the hostname string. When Netrw processes a remote URL such as scp://hostname/path/, it builds shell commands for directory listing and file transfer, and the injected metacharacters are passed unsanitized to the shell via Vim's :r! Ex command. The fix in patch v9.2.0073 implements stricter RFC1123 hostname and IP validation and applies shellescape() to the hostname and port before constructing shell commands (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the user running the Vim process, resulting in high confidentiality, integrity, and availability impact on the local system. An attacker could read sensitive files, modify or delete data, or establish persistence depending on the user's privilege level. The attack requires user interaction — the victim must open a maliciously crafted URL in Vim — which limits the attack surface but does not eliminate risk in environments where users routinely open remote files via Vim's netrw plugin. Downstream products including Microsoft's Azure Linux (azl3_vim, cbl2_vim) and IBM API Connect are also affected (GitHub Advisory, IBM Advisory).

1. Craft a malicious URL: Construct a URL using the scp:// (or similar) protocol handler with shell metacharacters embedded in the hostname field, e.g., scp://x;touch /tmp/pwned;x/path/. The semicolons allow injection of additional shell commands.
2. Deliver the URL to the victim: Social-engineer the target user into opening the crafted URL in Vim — for example, via a phishing email, a malicious document, or a shared file containing the URL as a link or argument.
3. Trigger netrw processing: When the user opens the URL in Vim (e.g., :e scp://x;touch /tmp/pwned;x/dir/), the netrw plugin parses the connection string and passes the unsanitized hostname to the shell via the :r! Ex command.
4. Achieve command execution: The injected shell metacharacters cause the shell to execute the attacker-supplied commands (e.g., touch /tmp/pwned) with the privileges of the Vim process, enabling file creation, data exfiltration, or further system compromise (GitHub Advisory, GitHub Commit).

• Process: Unexpected child processes spawned by Vim (e.g., sh, bash, touch, curl, wget, python) when a user opens a remote URL via netrw.
• Logs: Shell history or audit logs showing commands executed with shell metacharacters embedded in scp:// or similar URLs; system audit logs (e.g., auditd) recording process creation events originating from the Vim process.
• File System: Unexpected files created or modified in directories writable by the user running Vim, particularly shortly after Vim was used to open a remote URL; new cron jobs, authorized_keys entries, or scripts created by the Vim process owner.
• Network: Outbound SSH or SCP connections to unexpected or unknown hosts initiated by the Vim process, potentially with malformed hostnames visible in network logs.

Upgrade Vim to version 9.2.0073 or later, which implements stricter RFC1123 hostname validation and applies shellescape() to hostname and port values in the s:MakeSshCmd() function. Patches have been distributed by major Linux vendors including Red Hat (multiple RHSA advisories), Ubuntu (USN-8101-1), SUSE (openSUSE security announce), Fedora, Mageia, Amazon Linux 2023, and others. If immediate patching is not possible, users should avoid opening URLs from untrusted sources in Vim, particularly those using scp://, ftp://, or other remote protocol handlers supported by netrw. Consider disabling the netrw plugin entirely by adding let g:loaded_netrw = 1 and let g:loaded_netrwPlugin = 1 to the Vim configuration file if remote file access via netrw is not required (GitHub Advisory, Vim Release).

The vulnerability was disclosed by Vim maintainer Christian Brabandt via the oss-security mailing list on February 27, 2026, crediting researchers ehdgks0627 and un3xploitable for identifying the flaw and providing the fix. The Vim project rated the severity as Moderate (4.4 CVSS) due to the required user interaction and the visibility of malformed URLs in interactive contexts, while NVD assigned a higher score of 7.8 (High). The vulnerability received broad coverage across Linux distribution security channels, with rapid patch uptake by Red Hat, Ubuntu, SUSE, Fedora, Mageia, and Amazon Linux. Social media activity was limited but present, with security community accounts sharing the advisory shortly after disclosure (Openwall OSS-Sec, GitHub Advisory).