CVE-2026-82636

Published: Aug 30, 2026Modified: Sep 8, 2026Deferred

7.9

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 6.0

Source: MITRE (Secondary)

Description

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://news.ycombinator.com/item?id=49496918

Source: cve@mitre.org

https://www.qubes-os.org/news/2026/08/29/qsb-118/

Source: cve@mitre.org

Timeline

No history available yet.