Vulnerability record/PUBLISHED/Published Apr 8, 2026 21:35:25 UTC
CVE-2026-40030
parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration.
Base score8.4/ 10
SeverityHighCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorLocalAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionActiveUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 8, 2026 14:02:42 UTC
PublishedApr 8, 2026 21:35:25 UTC
ReservedApr 8, 2026 13:36:50 UTC
Credits
- Mobasi Security Team