CVE-2026-40029

CVE-2026-40029 is an OS command injection vulnerability in parseUSBs versions before 1.9, where unsanitized .lnk file paths are passed directly into shell commands via os.popen(), enabling arbitrary command execution. An attacker can craft malicious .lnk filenames containing shell metacharacters that execute arbitrary commands when a forensic examiner processes USB artifacts using the affected tool. The vulnerability has a CVSS score of 7.8 (HIGH) with a local attack vector requiring user interaction but no special privileges. The impact is severe, allowing an attacker to achieve high-level compromise of confidentiality, integrity, and availability on the examiner's machine during routine forensic analysis activities. There is currently no evidence of active exploitation, with an EPSS score of 0.00028 indicating minimal real-world exploit activity. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and shows low community attention, though organizations using parseUSBs for digital forensics should still prioritize updating to version 1.9 or later to mitigate the risk.