Description
The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Scores
CVSS v3
8.1
EPSS
0.0075
EPSS Percentile
73.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-88
Status
published
Products (2)
cocoapods/cocoapods-downloader
< 1.6.2
rubygems/cocoapods-downloader
0 - 1.6.2RubyGems
Published
Apr 01, 2022
Tracked Since
Feb 18, 2026