CVE-2026-40029CWE-78

parseusbs < 1.9 Command Injection via Crafted LNK Filename

High · published April 8, 2026

CVSS v4.0
8.5
EPSS
1%
Percentile
70.8
In the wild
Unconfirmed
What it is

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01328 · 70.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-04-08T21:35Z
EPSS history
Timeline
  • 08 APR 21:35Z
    parseusbs < 1.9 Command Injection via Crafted LNK Filename
    cvelistv5