HIGH8.1

GHSA-g397-v4w5-4m79

Command injection in cocoapods-downloader

Quick fix

GHSA-g397-v4w5-4m79 — cocoapods-downloader: upgrade to the fixed version with the command below.

bundle update cocoapods-downloader

Details

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/cocoapods-downloader

Introduced in: 0Fixed in: 1.6.2

Fixbundle update cocoapods-downloader

References

https://nvd.nist.gov/vuln/detail/CVE-2022-21223[ADVISORY]
https://github.com/CocoaPods/cocoapods-downloader/pull/127[WEB]
https://github.com/CocoaPods/cocoapods-downloader[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cocoapods-downloader/CVE-2022-21223.yml[WEB]
https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414280[WEB]