EUVD-2026-68212
GHSA-ppf9-cgjm-478m
Severity by source
AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attacker operates via adjacent qrexec channel from a controlled qube (AV:A); dom0 user must initiate copy to attacker's specific qube (AC:H/UI:R); dom0 compromise cascades to all managed qubes, changing scope (S:C) with full impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.
AnalysisAI
OS command injection in Qubes OS (qubes-core-dom0-linux before 4.3.22) allows an attacker who controls any qube to execute arbitrary commands in dom0 - the privileged hypervisor control domain - when a dom0 operator runs qvm-copy-to-vm targeting that attacker-controlled qube. The root cause (CWE-78) is qfile-dom0-agent.c passing unsanitized, attacker-crafted error messages to the C system() function, where embedded shell metacharacters are interpreted as commands in the dom0 shell context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must be met simultaneously: (1) the attacker must control a qube on the target Qubes OS installation, achieved either through prior compromise of an existing qube or by the attacker operating any qube (including an untrusted AppVM) on the system; and (2) a dom0 user must run qvm-copy-to-vm with the attacker-controlled qube as the destination target. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.9 score with Changed Scope and full C/I/A impact accurately reflects the catastrophic consequence of dom0 compromise, yet two structural prerequisites keep real-world exploitation materially harder than the score alone implies: the attacker must already control a qube on the target system (requiring prior foothold or legitimate user status), and a dom0 operator must voluntarily run qvm-copy-to-vm targeting that specific qube (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade qubes-core-dom0-linux to version 4.3.22 or later per Qubes Security Bulletin QSB-118 (https://www.qubes-os.org/news/2026/08/29/qsb-118/); this is the vendor-confirmed patch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today