The parseusbs tool (versions before 1.9) has an OS command injection vulnerability (CWE-78) in parseUSBs.py. It improperly neutralizes special elements by passing LNK file paths directly into os.popen() without sanitization. An attacker can exploit this by crafting .lnk filenames containing shell metacharacters, which are executed on the host system when the tool parses USB artifacts. This allows arbitrary command execution with the privileges of the user running parseusbs. The vulnerability is publicly known as CVE-2026-40029 with a CVSS 4.0 score of 8.5, indicating high severity. No patch or official remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to execute arbitrary OS commands on the forensic examiner's machine during USB artifact analysis. This can lead to compromise of the host system, data theft, or further system manipulation. The impact is high due to the ability to execute commands with the user's privileges and the lack of input sanitization in the vulnerable script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid parsing untrusted or potentially malicious .lnk files with parseusbs. Running the tool in a restricted or isolated environment may reduce risk. Monitor vendor channels for updates or patches addressing this vulnerability.