The vulnerability is an OS command injection flaw in parseusbs, present in all versions before 1.9, caused by unsanitized .lnk filenames being fed directly into an os.popen() shell command. An attacker can craft a .lnk filename containing shell metacharacters, causing the forensic parser to execute arbitrary commands on the host machine. This flaw is a classic command‑line injection (CWE‑78) that can lead to full control of the machine running the parser.

The affected product is parseusbs by khyrenz. All installations of parseusbs older than version 1.9 are vulnerable. No specific sub‑version is listed beyond the major release cutoff.

The CVSS score of 8.5 indicates a high severity vulnerability. The EPSS score is below 1%, meaning real‑world exploitation is currently unlikely, but the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to provide a USB drive with a specially crafted .lnk file and run parseusbs on a machine that will parse that file; thus the attack vector is local‑file based with the ability to execute arbitrary system commands.