The vulnerability CVE-2026-40029 in khyrenz parseusbs (versions before 1.9) is an OS command injection issue. The parseUSBs.py script passes LNK file paths directly into an os.popen() shell command without sanitization. An attacker can craft .lnk filenames with embedded shell metacharacters that cause arbitrary command execution on the forensic examiner's machine during USB artifact parsing. This vulnerability is identified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS 4.0 base score is 8.5, indicating high severity. No patch or official remediation guidance is currently available.

Successful exploitation allows an attacker to execute arbitrary OS commands on the forensic examiner's machine with no privileges required and no user interaction needed beyond parsing the malicious .lnk file. This can lead to full system compromise or unauthorized actions during forensic analysis of USB devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid parsing untrusted or suspicious USB artifacts with parseusbs. Consider manual inspection or alternative tools that do not execute shell commands with unsanitized input.