CVE-2026-82636CWE-78command-injection

CVE-2026-82636

High · published August 30, 2026

CVSS v3.1
7.9
EPSS
2%
Percentile
79.8
In the wild
Unconfirmed
What it is

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.

The record
Technical detail
CVSS v3.1
7.9 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01922 · 79.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-30T18:17Z
References (2)
https://news.ycombinator.com/item?id=49496918 · [email protected]https://www.qubes-os.org/news/2026/08/29/qsb-118/ · [email protected]
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 1%
    epss
  • 30 AUG 13:05Z
    Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the…
    cvelistv5