CVE-2026-40030
parseusbs < 1.9 Command Injection via Volume Path Argument
Description
parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration.
INFO
Published Date :
April 8, 2026, 10:16 p.m.
Last Modified :
July 24, 2026, 9:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update parseusbs to version 1.9 or later.
- Sanitize all user-supplied path arguments.
- Avoid using shell commands for critical operations.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-40030.
| URL | Resource |
|---|---|
| https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b | Patch |
| https://github.com/khyrenz/parseusbs/pull/10 | Issue Tracking |
| https://mobasi.ai/sentinel | Third Party Advisory |
| https://www.vulncheck.com/advisories/parseusbs-command-injection-via-volume-path-argument | Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-40030 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-40030
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-40030 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-40030 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 24, 2026
Action Type Old Value New Value Added Translation Title: parseusbs de khyrenz, Description: parseusbs anterior a la versión 1.9 contiene una vulnerabilidad de inyección de comandos del sistema operativo donde el argumento de la ruta de listado de volúmenes (bandera -v) se pasa sin sanitizar a un comando de shell os.popen() con ls, permitiendo la inyección de comandos arbitrarios a través de argumentos de ruta de volumen manipulados que contienen metacaracteres de shell. Un atacante puede proporcionar una ruta de volumen manipulada a través de la bandera -v que inyecta comandos arbitrarios durante la enumeración del contenido del volumen. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'khyrenz', 'product': 'parseusbs', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.9.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '1.9.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '99f05996494e7e41ea0c7e13145ba20eb793e46b', 'versionType': 'git'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-40030', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-04-09T18:07:55.498397Z'} -
Initial Analysis by [email protected]
Apr. 13, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:khyrenz:parseusbs:*:*:*:*:*:*:*:* versions up to (excluding) 1.9 Added Reference Type VulnCheck: https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b Types: Patch Added Reference Type VulnCheck: https://github.com/khyrenz/parseusbs/pull/10 Types: Issue Tracking Added Reference Type VulnCheck: https://mobasi.ai/sentinel Types: Third Party Advisory Added Reference Type VulnCheck: https://www.vulncheck.com/advisories/parseusbs-command-injection-via-volume-path-argument Types: Third Party Advisory -
New CVE Received by [email protected]
Apr. 08, 2026
Action Type Old Value New Value Added Description parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration. Added CVSS V4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-78 Added Reference https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b Added Reference https://github.com/khyrenz/parseusbs/pull/10 Added Reference https://mobasi.ai/sentinel Added Reference https://www.vulncheck.com/advisories/parseusbs-command-injection-via-volume-path-argument