CVE-2026-40030

HighPublic PoC

Published: 08 April 2026

Published

08 April 2026

Modified

13 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0003 7.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40030 is a high-severity OS Command Injection (CWE-78) vulnerability in Khyrenz Parseusbs. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 7.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 requires input validation at system interfaces, directly preventing OS command injection by sanitizing the unsanitized volume path argument passed to os.popen().

SI-2 Flaw Remediation good match

prevent

SI-2 ensures timely flaw remediation by applying the patch in parseusbs version 1.9 that fixes the command injection vulnerability.

AC-6 Least Privilege partial match

prevent

AC-6 enforces least privilege, limiting the impact of arbitrary commands injected via the crafted -v flag by restricting process privileges.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

OS command injection via unsanitized -v argument to os.popen() enables arbitrary Unix shell command execution (T1059.004) by exploiting the vulnerable local client tool (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An…

attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration.

Deeper analysisAI

CVE-2026-40030 is an OS command injection vulnerability (CWE-78) affecting parseusbs versions before 1.9. The flaw occurs when the volume listing path argument provided via the -v flag is passed unsanitized into an os.popen() shell command that executes ls, enabling arbitrary command injection through crafted volume path arguments containing shell metacharacters. This issue was published on 2026-04-08 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A local attacker can exploit this vulnerability by tricking a user into running parseusbs with a specially crafted -v flag argument during volume content enumeration. No privileges are required (PR:N), but the attack demands local access (AV:L), low complexity (AC:L), and user interaction (UI:R) to execute the malicious command. Successful exploitation allows the attacker to inject and execute arbitrary operating system commands, potentially resulting in high confidentiality, integrity, and availability impacts.

Mitigation is available through the patch in parseusbs version 1.9, as detailed in the upstream GitHub commit (99f05996494e7e41ea0c7e13145ba20eb793e46b) and pull request (#10). Additional guidance appears in advisories from VulnCheck and other sources linked in the CVE references.