Executive brief
parseusbs is a digital forensics tool used to analyze USB device history on a system. A security flaw allows an attacker to execute unauthorized commands on a user's computer if the user is tricked into processing a specially crafted volume path. This could lead to a full system compromise, data theft, or the installation of malicious software.
Technical details
An OS command injection vulnerability exists in parseusbs versions prior to 1.9 due to improper neutralization of shell metacharacters in the volume listing path argument. The application passes the value of the '-v' flag directly into an 'os.popen()' call executing the 'ls' command. A local attacker can exploit this by providing a crafted path containing shell operators (e.g., semicolons or backticks), leading to arbitrary code execution with the privileges of the user running the tool. This requires user interaction, as a user must execute the tool against the malicious input. The issue was fixed in version 1.9 by replacing the shell-based 'os.popen' call with 'os.listdir()'.
Affected products
- khyrenz parseusbs < 1.9
Timeline
- 2026-02-03: other: Fix submitted via pull request
- 2026-02-08: patched: Fix merged into main branch
- 2026-04-08: disclosed: Initial vulnerability disclosure
- 2026-04-08: advisory: NVD publication date