The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2022-04-01T17:35:21.022818Z

Updated: 2024-09-17T00:42:09.592Z

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-21223

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-04-01T18:15:08.603

Modified: 2024-11-21T06:44:08.770

Link: CVE-2022-21223

cve-icon Redhat

No data.