---
id: CVE-2026-40029
title: parseusbs < 1.9 Command Injection via Crafted LNK Filename
summary: >-
  parseusbs before 1.9 contains an OS command injection vulnerability in
  parseUSBs.py where LNK file paths are passed unsanitized into an os.popen()
  shell command, allowing arbitrary command execution via crafted .lnk filenames
  containing …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: khyrenz
product: parseusbs
affected:
  - parseusbs < 1.9.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-04-09T14:48:22.522386Z'
published: '2026-04-08'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T10:14:08.811Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-40029'
references:
  - url: 'https://github.com/khyrenz/parseusbs/pull/10'
    label: Pull Request
  - url: >-
      https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b
    label: Patch Commit
  - url: 'https://mobasi.ai/sentinel'
    label: Mobasi Sentinel Vulnerability Index
  - url: >-
      https://www.vulncheck.com/advisories/parseusbs-command-injection-via-crafted-lnk-filename
    label: >-
      VulnCheck Advisory: parseusbs < 1.9 Command Injection via Crafted LNK
      Filename
tags:
  - cve.org
epss: 0.00805
epssPercentile: 0.56555
ingestedAt: '2026-10-27T16:11:59.268Z'
---

## Overview

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.

## Affected

- `parseusbs < 1.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.