https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T23:23:01.182297+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-82636 fkie_cve-2026-82636 2026-09-30T23:23:01.617842+00:00

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.

 https://vulnerability.circl.lu/vuln/ghsa-ppf9-cgjm-478m GHSA-ppf9-cgjm-478m 2026-09-30T23:23:01.617946+00:00

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.