QubesOS flaw lets a malicious qube run arbitrary code in dom0 via qvm-copy-to-vm error reporting

Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel

Qubes Security Bulletin 118 discloses a critical vulnerability in qvm-copy-to-vm's error reporting. When copying a file from dom0 to a compromised qube, the qube can inject shell commands into dom0 by crafting a malicious filename. The flaw lies in insufficient sanitization: only non-ASCII characters and double quotes are stripped, leaving shell metacharacters intact, which are then passed to system() in the dom0 error dialog. All Qubes OS releases are affected; the fix is in qubes-core-dom0-linux 4.3.22. Discovered by Tim C., the vulnerability allows full takeover of Qubes OS.