The parseusbs utility prior to version 1.9 is vulnerable to OS command injection (CWE-78) because it passes the volume listing path argument (-v flag) directly into an os.popen() call with the ls command without sanitization. This allows an attacker to craft volume path arguments containing shell metacharacters that execute arbitrary commands on the host system during volume enumeration. The vulnerability is local attack vector with low attack complexity but requires user interaction. It has high impact on confidentiality, integrity, and availability. No official fix or patch is currently documented.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the parseusbs process. This can lead to unauthorized system access, data compromise, or disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input with the -v flag in parseusbs. Restrict usage of parseusbs to trusted users and environments. Monitor vendor channels for updates or official patches.