If you take a look at the demo shown in the blog post, it seems to show that you don't need to run tmux to be vulnerable. The demo video user is just in a normal tab.

https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/sec...