CVE-2026-40029

HIGH

parseusbs < 1.9 Command Injection via Crafted LNK Filename

Title source: cna
STIX 2.1

Description

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.

References (4)

Core 4
Core References
Product product
Pull Request
https://github.com/khyrenz/parseusbs/pull/10
Vendor Advisory vendor-advisory
Mobasi Sentinel Vulnerability Index
https://mobasi.ai/sentinel
Third Party Advisory third-party-advisory
VulnCheck Advisory: parseusbs < 1.9 Command Injection via Crafted LNK Filename
https://www.vulncheck.com/advisories/parseusbs-command-injection-via-crafted-lnk-filename

Scores

CVSS v3 7.8
EPSS 0.0080
EPSS Percentile 51.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (5)
khyrenz/parseusbs < 1.9 (2 CPE variants)
khyrenz/parseusbs < 1.9.0
khyrenz/parseusbs 1.9
khyrenz/parseusbs 1.9.0
khyrenz/parseusbs 99f05996494e7e41ea0c7e13145ba20eb793e46b
Published Apr 08, 2026
Tracked Since Apr 09, 2026