CVE-2026-40030
Published: 08 April 2026
Summary
CVE-2026-40030 is a high-severity OS Command Injection (CWE-78) vulnerability in Khyrenz Parseusbs. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 49.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-40030 is an OS command injection vulnerability (CWE-78) affecting parseusbs versions before 1.9. The flaw occurs when the volume listing path argument provided via the -v flag is passed unsanitized into an os.popen() shell command that executes ls, enabling arbitrary command injection through crafted volume path arguments containing shell metacharacters. This issue was published on 2026-04-08 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A local attacker can exploit this vulnerability by tricking a user into running parseusbs with a specially crafted -v flag argument during volume content enumeration. No privileges are required (PR:N), but the attack demands local access (AV:L), low complexity (AC:L), and user interaction (UI:R) to execute the malicious command. Successful exploitation allows the attacker to inject and execute arbitrary operating system commands, potentially resulting in high confidentiality, integrity, and availability impacts.
Mitigation is available through the patch in parseusbs version 1.9, as detailed in the upstream GitHub commit (99f05996494e7e41ea0c7e13145ba20eb793e46b) and pull request (#10). Additional guidance appears in advisories from VulnCheck and other sources linked in the CVE references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20771
Vulnerability details
parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An…
more
attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via unsanitized -v argument to os.popen() enables arbitrary Unix shell command execution (T1059.004) by exploiting the vulnerable local client tool (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires input validation at system interfaces, directly preventing OS command injection by sanitizing the unsanitized volume path argument passed to os.popen().
SI-2 ensures timely flaw remediation by applying the patch in parseusbs version 1.9 that fixes the command injection vulnerability.
AC-6 enforces least privilege, limiting the impact of arbitrary commands injected via the crafted -v flag by restricting process privileges.