Skip to content

Command Injection Vulnerability in cocoapods-downloader via git Arguments #471

Description

@yuzhongqi

Issue Description:
The cocoapods-downloader package before version 1.6.0, and versions 1.6.2 through 1.6.3, is vulnerable to command injection when using git. Specifically, the Pod::Downloader.preprocess_options function passes both the git and branch parameters directly to the git ls-remote subcommand without proper sanitization. This allows an attacker to inject additional git flags, potentially leading to arbitrary command execution on the system.

Recommendation:
Upgrade cocoapods-downloader to version 1.6.0 or later to mitigate this vulnerability.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions