Executive brief
parseusbs is an open-source digital forensics tool used by investigators to analyze USB artifact data. A security flaw allows an attacker to execute malicious commands on a forensic examiner's computer by providing a specially named shortcut (.lnk) file. This could lead to the compromise of the investigator's workstation, potentially affecting the integrity of evidence or leading to data theft.
Technical details
An OS command injection vulnerability exists in parseUSBs.py within the parseusbs tool prior to version 1.9. The root cause is the unsanitized passing of LNK file paths into the os.popen() function, which invokes a shell. An attacker can exploit this by crafting a .lnk file with a filename containing shell metacharacters (e.g., semicolons or backticks). When a forensic examiner uses the tool to parse a directory containing the malicious file, the embedded commands are executed with the privileges of the user running the script. The issue has been addressed in version 1.9 by replacing shell-based calls with safer alternatives like os.listdir() and subprocess.run() without shell=True.
Affected products
- khyrenz parseusbs < 1.9
Timeline
- 2026-02-03: other: Pull request with fix submitted
- 2026-02-08: patched: Fix merged into main branch
- 2026-04-08: disclosed: Initial disclosure and CVE assignment
- 2026-04-08: advisory