qvm-copy-to-vm
AssessTools
A Qubes OS command-line tool for copying files from dom0 to a selected qube.
Why it's here
Placed in Assess: 1 article(s) of evidence from 1 source(s), led by security coverage, with 0 in the last 30 days. Confidence 24%. Low accumulated evidence, so it defaults conservatively pending more signal.
Evidence (1)
- 8Hacker News·8/30/2026securityArbitrary code execution vulnerability in Qubes OS file copy flow
Qubes OS disclosed a security bulletin describing a vulnerability in `qvm-copy-to-vm` error reporting that can lead to arbitrary command execution in dom0. The issue arises because a target qube can influence the filename shown in an error dialog, and the resulting command is passed to `system()` with insufficient sanitization. Users are advised to continue normal updates to receive the fix.