CVE-2026-47273
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
May 27, 2026
CISA due date
—
The record
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB device serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates. This vulnerability is fixed in 0.9.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-2310 IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML… CWE-91
- CVE-2026-83617 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-91
- CVE-2026-83616 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-91
- CVE-2026-83618 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-91
- CVE-2026-83608 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-91
- CVE-2026-83605 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-91
- CVE-2026-83607 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-91
- CVE-2026-83609 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-91