CVE-2026-40030: Khyrenz Parseusbs

High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days.

parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration.

Affected products

• Khyrenz Parseusbs: before 1.9 (fixed in 1.9)

Published 2026-04-08. Last modified 2026-07-24.