Dashboard / CVE-2026-40029

CVE-2026-40029

HIGH
MEDIUM Priority: 0.07 BB Relevance: 42/100
Published: 2026-04-08 Modified: 2026-10-27 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
AT: None
VC: High
VI: High
VA: High

Description

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
khyrenz parseusbs < 1.9

References & Advisories (4)

https://mobasi.ai/sentinel
Third Party Advisory

Bug Bounty Relevance

42 / 100
✓ No authentication
✓ Low complexity

CVSS Score

8.5 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.80%
Raw Score 0.008050
Percentile 56.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00805
2026-10-28
0.00805

Intelligence Sources

mitre ref →

External Links