What’s Vulnerable › Vulnerabilities

CVE-2026-40029: parseusbs < 1.9 Command Injection via Crafted LNK Filename

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-08 · updated 2026-10-27
• Weakness: CWE-78

Description

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.

Affected products

• khyrenz parseusbs: before 1.9 — fixed in 1.9
• khyrenz parseusbs: before 1.9.0 — fixed in 1.9.0

How to fix

Upgrade to a fixed version: khyrenz parseusbs 1.9; khyrenz parseusbs 1.9.0. Check the vendor advisory for mitigations.

References

• https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b
• https://github.com/khyrenz/parseusbs/pull/10
• https://mobasi.ai/sentinel
• https://www.vulncheck.com/advisories/parseusbs-command-injection-via-crafted-lnk-filename

Get alerted when CVE-2026-40029 or the next vulnerability affects your stack