CVE-2026-40029

HighCVSS 7.8

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.81%

53th percentile - higher than 53% of all known CVEs

Summary

A vulnerability in parseusbs prior to version 1.9 allows OS command injection via unsanitized LNK file paths passed to os.popen(). An attacker can embed shell metacharacters in a .lnk filename, leading to arbitrary command execution on the forensic examiner's machine.

Risk Assessment

An attacker can execute arbitrary commands on the examiner's machine during USB artifact parsing, potentially leading to system compromise.

Recommendation

Update parseusbs to version 1.9 or later.

Other vulnerabilities in parseusbs

CVE-2026-40030High
The parseusbs tool before version 1.9 contains an OS command injection vulnerability. The volume path argument (-v flag) is passed unsanitized to os.popen() with the ls command, allowing arbitrary command injection via shell metacharacters.

Original NVD description (English source)

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.