{
  "id": 4390847,
  "title": "Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel",
  "url": "https://urgent.news/2026/08/30/arbitrary-code-execution-in-qubesos-via-copy-to-vm-error-reporting",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-30T08:51:39.000Z",
  "source": {
    "name": "Hacker News",
    "slug": "hacker-news",
    "url": "https://www.qubes-os.org/news/2026/08/29/qsb-118/"
  },
  "original_language": "en",
  "account": "The Qubes security team has issued Qubes Security Bulletin (QSB) 118, warning of arbitrary code execution in QubesOS. The bulletin details a vulnerability in the qvm-copy-to-vm error reporting feature, which could allow attackers to execute malicious code within the Dom0 operating system. This Bulletin provides instructions on how to assess and mitigate the risk associated with this vulnerability. The Qubes team has signed the QSB using their cryptographic PGP key, allowing users to verify its authenticity and ensure they are not misled by a forged bulletin. To confirm the QSB's validity, users must import and authenticate the Qubes Master Signing Key (QMSK) through a process involving GnuPG, a trusted cryptographic tool. Once the QMSK's authentication is verified, users are advised to set its trust level to the highest \"ultimate\" setting. Afterward, users can verify the bulletin's associated signature files using the authenticated QMSK to ascertain the bulletin's legitimacy.",
  "summary": null,
  "key_points": [
    "QubesOS vulnerability allows arbitrary code execution in Dom0",
    "Error reporting feature exploited to execute malicious code",
    "Users instructed to verify Qubes Security Bulletin authenticity"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}