Security vulnerabilities and automated fixes for qemu img issues
1 post found
A VM provisioning script that downloads a cloud image to a fixed path and then runs `qemu-img info` on it had no check that the path was still a regular file by the time the inspection call ran. An automated CWE-78 scan flagged the pattern as command-injection-adjacent; the fix adds an explicit `os.path.islink()` guard so the script refuses to process a symlink instead of silently inspecting whatever file the link resolves to.