PT-2026-31467 · Git+1 · Parseusbs

CVE-2026-40030 · Published 2026-04-08 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions parseusbs versions prior to 1.9

Description An OS command injection issue exists where the volume listing path argument provided via the -v flag is passed unsanitized into an os.popen() shell command using ls. This allows an attacker to inject and execute arbitrary commands during volume content enumeration by providing crafted volume path arguments containing shell metacharacters.

Recommendations Update parseusbs to version 1.9 or later. Avoid using the -v flag with untrusted volume path arguments.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40030

Affected Products

Parseusbs

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40030.json · Exploit
• https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b · Patch
• https://mobasi.ai/sentinel · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40030 · Security Note
• https://osv.dev/vulnerability/CVE-2026-40030 · Vendor Advisory
• https://github.com/khyrenz/parseusbs/pull/10 · Note
• https://vulncheck.com/advisories/parseusbs-command-injection-via-volume-path-argument · Note