← Back to CVEs

CVE-2026-40029

HIGH

7.8

Description

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.

CVE Details

CVSS v3.1 Score7.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published4/8/2026

Last Modified4/13/2026

Sourcenvd

Honeypot Sightings0

Affected Products

khyrenz:parseusbs

Weaknesses (CWE)

CWE-78

References

https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b(disclosure@vulncheck.com)

https://github.com/khyrenz/parseusbs/pull/10(disclosure@vulncheck.com)

https://mobasi.ai/sentinel(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/parseusbs-command-injection-via-crafted-lnk-filename(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.