A critical OS command injection vulnerability in the khyrenz parseusbs library allows for arbitrary command execution when processing crafted volume paths.

This vulnerability is a classic OS command injection (CWE-78) triggered when the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command. An unauthenticated attacker can exploit this by providing a malicious volume path containing shell metacharacters during the enumeration process.

Successful exploitation allows an attacker to execute arbitrary commands on the underlying host system with the privileges of the parseusbs process. This represents a significant risk to system integrity and confidentiality, as it could lead to full system compromise or unauthorized data exfiltration. The CVSS score of 7.8 confirms the high severity of this flaw, reflecting the potential for total technical impact on the affected host.

Immediate Action: Update the parseusbs library to version 1.9.0 or later, which includes the necessary sanitization of the volume path argument.

Proactive Monitoring: Monitor system process logs for suspicious commands originating from the parseusbs service, particularly those involving shell execution or unexpected file system access.

Compensating Controls: If an immediate update is not possible, restrict the input provided to the -v flag to ensure it contains only expected alphanumeric characters and does not include shell metacharacters.

Public Exploit Available: No (exploit_available: false)

The presence of a command injection flaw in a library that processes external input poses a high risk to any application relying on parseusbs. Organizations should prioritize updating to version 1.9.0 immediately to eliminate this vector for remote command execution. Failure to patch may expose the host environment to arbitrary code execution if an attacker can influence the volume path parameter.