The vulnerability CVE-2026-40029 in khyrenz parseusbs (versions before 1.9) is an OS command injection flaw in parseUSBs.py. It arises because the software passes unsanitized LNK file paths directly into an os.popen() shell command. An attacker can exploit this by crafting .lnk filenames containing shell metacharacters, which leads to arbitrary command execution on the forensic examiner's machine during USB artifact parsing. This vulnerability is categorized under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS 4.0 base score is 8.5, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows an attacker to execute arbitrary OS commands on the forensic examiner's machine when parsing maliciously crafted .lnk files. This can lead to compromise of the host system, data theft, or further system manipulation. The impact is high due to the ability to execute arbitrary commands with the privileges of the user running parseusbs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid parsing untrusted or suspicious USB artifacts with parseusbs versions prior to 1.9. Implementing manual sanitization or running the tool in a restricted environment may reduce risk.