Vulnerability · Published Apr 8, 2026 · Assigned by VulnCheck

CVE-2026-40030parseusbs < 1.9 Command Injection via Volume Path Argument

High 7.8

In plain English

A high-severity OS command injection in parseusbs from khyrenz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.8%top 44.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration.

Affected products (as reported)

Vendor	Product	Versions
khyrenz	parseusbs	0 – before 1.9.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Pull Request issue-tracking
Patch Commit patch
Mobasi Sentinel Vulnerability Index vendor-advisory
VulnCheck Advisory: parseusbs < 1.9 Command Injection via Volume Path Argument third-party-advisory