OS Command Injection Vulnerability in Parseusbs by Khyrenz

CVE-2026-40029

What is CVE-2026-40029?

The Parseusbs tool by Khyrenz, prior to version 1.9, is susceptible to an OS command injection flaw. This vulnerability arises in the parseUSBs.py script, where file paths from .lnk files are improperly sanitized before being executed in a shell command via os.popen(). Malicious actors can exploit this issue by crafting .lnk filenames that include shell metacharacters, leading to arbitrary command execution on the machine that parses USB artifacts. This poses significant risks to forensic examiners and their systems, making it essential for users to update to the latest version to mitigate potential attacks.

References