CVE-2020-28086

CVE-2020-28086 affects zx2c4 password_store (pass) version 1.7.3, allowing an attacker to trick a user into decrypting and using an unintended password for a service controlled by the attacker. This high-severity vulnerability (CVSS 7.5) requires an attacker to control the Git server or another user's machine, rename a password file, and for the victim to perform a git pull, decrypt the renamed file, and log into a malicious service. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability. Organizations concerned with this threat model can mitigate the risk by signing Git commits.