$ cve CVE-2018-12356 JSON

CVE-2018-12356

9.8

CRITICAL · CVSS 3.0 · EPSS 4.6% (pctl 91)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution.

Scoring

CVSS	9.8 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	4.59% — more likely to be exploited than 91% of all CVEs
Weakness	CWE-347
On CISA KEV	no
Public exploit	none known
Published	2018-06-15
Last modified	2026-06-17

Affected (1)

Vendor	Product
simple password store project	simple password store

References

→ the Explorer · watch your stack · NVD