The vulnerability in khyrenz parseusbs prior to version 1.9 arises from the unsanitized use of the volume listing path argument (-v flag) in an os.popen() call executing the 'ls' command. This improper neutralization of special elements (CWE-78) enables an attacker to inject arbitrary OS commands by crafting volume path arguments containing shell metacharacters. The flaw can be exploited during volume content enumeration, potentially allowing execution of arbitrary commands with the privileges of the parseusbs process.

Successful exploitation allows an attacker to execute arbitrary OS commands on the affected system with the privileges of the parseusbs process. This can lead to unauthorized system access, data disclosure, or system compromise depending on the environment and privileges of the process. The CVSS 4.0 score of 8.4 reflects high impact due to the potential for remote exploitation with low attack complexity and no required privileges, but user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using parseusbs versions prior to 1.9 with untrusted input for the -v flag. Restrict usage to trusted users and environments, and consider alternative tools that do not exhibit this vulnerability.