The vulnerability in khyrenz parseusbs (CVE-2026-40030) is an OS command injection caused by improper neutralization of special elements in the volume listing path argument passed with the -v flag. The argument is directly used in an os.popen() call with the ls command without sanitization, allowing attackers to inject arbitrary shell commands by including shell metacharacters in the volume path. This affects parseusbs versions before 1.9, specifically version 0 as stated. The CVSS 4.0 score is 8.4 (high severity), reflecting the potential for high impact if exploited. No official patch or remediation is currently documented, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the parseusbs process by injecting commands through the volume path argument. This can lead to unauthorized command execution, potentially compromising system integrity and confidentiality during volume content enumeration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input for the -v flag or running parseusbs in environments where untrusted users can supply volume path arguments. Monitor vendor channels for updates regarding an official fix.