GoKawiilQubes OS patches Dom0 code execution flaw in qvm-copy-to-vm tool
Qubes OS disclosed QSB 118, a vulnerability in the qvm-copy-to-vm utility that lets a compromised qube inject arbitrary commands into dom0 when a user copies files to it. The flaw stems from insufficient sanitization of a file name reported back through the qfile protocol's error-reporting mechanism, which dom0 displays without properly neutralizing malicious content. Users are advised to update normally to receive the fix, with no other action required.
GoKawiil's interpretation of the reporting above, not reported fact.
Dom0 is the most privileged component in Qubes OS's security model, isolating untrusted virtual machines from the trusted host, so any path allowing a compromised qube to execute code in dom0 undermines the entire isolation architecture the OS is built on. This bug shows how even simple administrative tools like file-copy utilities can become attack vectors if error-handling and input sanitization are not rigorously applied.
- A compromised qube can exploit qvm-copy-to-vm's error reporting to run arbitrary commands in dom0.
- The bug lies in improper sanitization of a filename passed through the qfile transfer protocol's confirmation message.
- Standard system updates will deliver the patch; no manual configuration changes are needed.
YubiKey 5 NFC Security Key — If you're the kind of person running Qubes OS and reading security bulletins, a hardware security key is a natural companion for locking down your accounts and verifying signed releases. The YubiKey 5 NFC works over USB-A and NFC and supports FIDO2/WebAuthn, OTP, and OpenPGP workflows. It's a durable, keychain-friendly way to add a physical factor to your defense-in-depth setup.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: qubes-os.org, 2026-08-30
Published there as: “Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.