{"id":"CVE-2026-40030","title":"parseusbs < 1.9 Command Injection via Volume Path Argument","summary":"parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-78"],"vendor":"khyrenz","product":"parseusbs","affected":["parseusbs < 1.9.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-04-09T18:07:55.498397Z"},"published":"2026-04-08","updated":"2026-10-27","sourceUpdated":"2026-10-27T10:14:09.487Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40030","references":[{"url":"https://github.com/khyrenz/parseusbs/pull/10","label":"Pull Request"},{"url":"https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b","label":"Patch Commit"},{"url":"https://mobasi.ai/sentinel","label":"Mobasi Sentinel Vulnerability Index"},{"url":"https://www.vulncheck.com/advisories/parseusbs-command-injection-via-volume-path-argument","label":"VulnCheck Advisory: parseusbs < 1.9 Command Injection via Volume Path Argument"}],"tags":["cve.org"],"epss":0.0075,"epssPercentile":0.54741,"ingestedAt":"2026-10-27T16:11:59.269Z","slug":"CVE-2026-40030","body":"## Overview\n\nparseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration.\n\n## Affected\n\n- `parseusbs < 1.9.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}