Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Link.filename path handling in pip.internal.models.link and the download path joins in pip.internal.network.download and pip.internal.req.reqinstall. An attacker can place files at arbitrary locations on disk...

CVE-2026-40029 parseusbs < 1.9 Command Injection via Crafted LNK Filename

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename wi...