CVE-2026-40030

HighCVSS 7.8

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.75%

51th percentile - higher than 51% of all known CVEs

Summary

The parseusbs tool before version 1.9 contains an OS command injection vulnerability. The volume path argument (-v flag) is passed unsanitized to os.popen() with the ls command, allowing arbitrary command injection via shell metacharacters.

Risk Assessment

An attacker can execute arbitrary system commands on the server, potentially leading to full system compromise, data leakage, or further attacks.

Recommendation

Update parseusbs to version 1.9 or later. If an update is not possible, avoid using the -v flag with untrusted input.

Other vulnerabilities in parseusbs

CVE-2026-40029High
A vulnerability in parseusbs prior to version 1.9 allows OS command injection via unsanitized LNK file paths passed to os.popen(). An attacker can embed shell metacharacters in a .lnk filename, leading to arbitrary command execution on the forensic examiner's machine.

Original NVD description (English source)

parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration.