OS Command Injection in parseusbs by Khyrenz

CVE-2026-40030

What is CVE-2026-40030?

In parseusbs versions prior to 1.9, an OS command injection flaw exists due to the vulnerable handling of the volume listing path argument specified by the -v flag. This argument is passed unsanitized to an os.popen() command, enabling attackers to inject arbitrary shell commands through crafted volume path arguments that include shell metacharacters. This vulnerability allows unauthorized execution of commands during volume content enumeration, posing significant security risks.

References