PT-2026-31466 · Khyrenz · Parseusbs

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-40029

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40029

Affected Products

Parseusbs

References · 5

• https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40029 · Security Note
• https://mobasi.ai/sentinel · Vendor Advisory
• https://github.com/khyrenz/parseusbs/pull/10 · Note
• https://vulncheck.com/advisories/parseusbs-command-injection-via-crafted-lnk-filename · Note