CVE-2026-44713 | mcdope pam_usb up to 0.8.6 on Linux socket-path src/tmux.c popen TMUX os command injection (GHSA-822m-whrh-vrj8)

A vulnerability categorized as critical has been discovered in mcdope pam_usb up to 0.8.6 on Linux. This vulnerability affects the function popen of the file src/tmux.c of the component socket-path. Executing a manipulation of the argument TMUX can lead to os command injection.

This vulnerability is handled as CVE-2026-44713. It is possible to launch the attack on the local host. There is not any exploit available.

It is advisable to upgrade the affected component.