Read the docs
TI-2022-05616 Aliases CVE-2022-21223GHSA-g397-v4w5-4m79

Command injection in cocoapods-downloader

Priority MEDIUM 45CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-88.

Summary

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Why it matters now

EPSS 0.01687 77th percentileScored 2026-11-07
Fix Fixed cocoapods-downloader: 1.6.2cocoapods-downloader (RubyGems): 1.6.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—cocoapods-downloaderbefore 1.6.21.6.2Patch availableCNA
—cocoapods-downloader (RubyGems)before 1.6.21.6.2Patch availableGHSA-g397-v4w5-4m79
  • cocoapods-downloader Vendor— Affected before 1.6.2 Fixed in 1.6.2 Patch available CNA
  • cocoapods-downloader (RubyGems) Vendor— Affected before 1.6.2 Fixed in 1.6.2 Patch available GHSA-g397-v4w5-4m79

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cocoapods:cocoapods-downloader:*:*:*:*:*:*:*:*before 1.6.2VulnerableCocoaPods
  • cpe:2.3:a:cocoapods:cocoapods-downloader:*:*:*:*:*:*:*:* Versions before 1.6.2 Vulnerable ·CocoaPods

Remediation

  • Fix · CNA cocoapods-downloader Fixed in 1.6.2
  • Fix · GHSA-g397-v4w5-4m79 cocoapods-downloader (RubyGems) Fixed in 1.6.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21223
  2. 2026-10-03 Alias added: GHSA-g397-v4w5-4m79

References

Patch 1

Advisory 1

Other 2

  • TI-2022-08312 Command injection in cocoapods-downloader CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences