Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel

A vulnerability in QubesOS's `qvm-copy-to-vm` tool allows an attacker to execute arbitrary code on dom0 (the hypervisor) if a user attempts to copy a file from dom0 to a compromised qube. The flaw exists in the error reporting mechanism, which fails to properly sanitize filenames returned by the target qube before passing them to a system command that displays error messages. Users should continue applying normal security updates to receive the patch for this critical vulnerability.