CVE-2026-47273

Published: May 27, 2026Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Exploitability: 2.2 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB device serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates. This vulnerability is fixed in 0.9.0.

Related CWEs

CWE-91

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (3)

https://github.com/mcdope/pam_usb/commit/721fed08a3596cb5b4671ad702f8fdc12dcc7420

Source: security-advisories@github.com

https://github.com/mcdope/pam_usb/pull/311

Source: security-advisories@github.com

https://github.com/mcdope/pam_usb/security/advisories/GHSA-vfj3-5h5v-6g93

Source: security-advisories@github.com

Timeline

No history available yet.