The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2022-04-01T17:35:13.314022Z

Updated: 2024-09-17T03:22:48.708Z

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-24440

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-04-01T18:15:08.767

Modified: 2024-11-21T06:50:25.453

Link: CVE-2022-24440

cve-icon Redhat

No data.