Cocoapods Downloader

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:cocoapods:cocoapods-downloader:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorCocoapods (38815938-908c-5c8e-98ad-e090b7ae08a8)
ProductCocoapods Downloader (ed9315fa-d47a-5a80-89e0-333ff4991640)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:gem/cocoapods-downloader purl2cpe 2026-06-01 10:16:44.981271
pkg:github/cocoapods/cocoapods-downloader purl2cpe 2026-06-01 10:16:44.981274

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-24440 vulnerable 2026-06-08 05:41:00.578829 Command Injection
HIGH (8.1)
The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Published: 2022-04-01T17:35:13.314Z
Updated: 2024-09-17T03:22:48.708Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-21223 vulnerable 2026-06-08 05:40:00.491006 Command Injection
HIGH (8.1)
The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Published: 2022-04-01T17:35:21.022Z
Updated: 2024-09-17T00:42:09.592Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.