CVE-2022-24440

RubyGems/cocoapods-downloader CVE-2022-24440: high 8.1, EPSS 2.62%

Command injection in cocoapods-downloader

Action: Upgrade cocoapods-downloader to 1.6.0 or later.

bundle update cocoapods-downloader

Affected

Fixed versions

Sources

• osv: GHSA-7627-mp87-jf6q
• https://nvd.nist.gov/vuln/detail/CVE-2022-24440
• https://github.com/CocoaPods/cocoapods-downloader/pull/124
• https://github.com/CocoaPods/cocoapods-downloader/pull/128
• https://github.com/CocoaPods/cocoapods-downloader/commit/52a0d54464932a90ded5a59c71a016e8dec0ca84
• https://github.com/CocoaPods/cocoapods-downloader/commit/b70bc39c75645aa6d4a01a3ca6de40477c84f4b5
• https://github.com/CocoaPods/cocoapods-downloader
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cocoapods-downloader/CVE-2022-24440.yml
• https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414278

CVE-2022-24440 · published 2022-04-02T00:00:13Z · modified 2026-07-08T06:50:04.049741640Z · JSON