CVE-2026-40029

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40029

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40029.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40029

Published

2026-04-08T21:35:24.801Z

Modified

2026-08-12T03:51:45.497329352Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

parseusbs < 1.9 Command Injection via Crafted LNK Filename

Details

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "1.9.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "1.9"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40029.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/khyrenz/parseusbs

Affected ranges

Type

GIT

Repo

https://github.com/khyrenz/parseusbs

Events

Introduced

Fixed

99f05996494e7e41ea0c7e13145ba20eb793e46b

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40029.json"