I tried sending a patch to fix this vulnerability last year but I don't think it was applied, and to be honest the patch needed more work from someone better at shell scripting than me. See https://blog.hackeriet.no/filename-rename-in-pass/ for my writeup of this.
Den ons 10 nov. 2021 kl 01:07 skrev David Mandelberg <[email protected]>: > > I just thought about one more thing. Would it be possible for the > signature to include the relative path too? > > browserpass-extension uses the relative path to determine what site the > password is for, so an attacker with write access could copy > good-site.example.com.gpg to attacker-controlled.example.net.gpg, then > collect the password on attacker-controlled.example.net.
