An IPv6 address can smuggle a shell command, and a valid-IP check waves it through

The original gripe: a character that means two things

Xe Iaso's note is, on its face, a UX complaint. IPv6 link-local addresses need a zone identifier — fe80::4%eth0 — to say which interface to use. But in a URL, % is the escape character, so a parser reading http://[fe80::4%eth0]:80 chokes on %et as a broken percent-encoding. RFC 6874 says the correct form double-escapes it into the genuinely unreadable http://[fe80::4%25eth0]:80. Browsers refuse to support it at all, Xe explains, because zone IDs "break the concept of an origin" that web security depends on. The author's own verdict: "I hate it, but what can you do?"

The thread turns a nuisance into a CVE-shaped problem

That's where Hacker News took a UI footnote and made it dangerous. One commenter pointed out that Python's ipaddress.ip_address() will validate a zoned string as a legitimate IPv6 address — and people use exactly that function as an is-this-a-safe-IP gate before handing the string onward:

"fe80::1%a;whoami>${PATH:0:1}tmp${PATH:0:1}pwned is a valid IPv6 IP, and if you did ping [that], you'd have the output of whoami written to /tmp/pwned." — an engineer demonstrating the injection

The validator says "yes, valid IP." The shell says "yes, valid command." That's the whole trap. The pushback was immediate and correct in spirit:

"Is this really a Python problem? subprocess.run for example defaults to shell=False… and on top of that you'd have to be passing untrusted input to a shell." — a developer reassigning the blame

The author of a coding book agreed it's a stretch to pin on IPv6 — IPv4 can't even represent this scenario, so the feature isn't the flaw. The thread also unearthed a delicious historical parallel: Microsoft's old UNC workaround for IPv6 literals used a special domain, ipv6-literal.net — and Microsoft then lost the domain registration.

The takeaway is older than IPv6

The zone-ID-in-URL ergonomics really are bad, and Xe is right to hate them. But the thread's more useful lesson is a classic one wearing new clothes: "this string is a valid IP address" is not the same claim as "this string is safe to interpolate." A type check is not a sanitizer. IPv6 just gave the oldest injection bug in the book a fresh, RFC-compliant disguise.