CocoaPods-RCE_CVE-2024-38366

CocoaPods-RCE 本仓库更深入地剖析了在研究与破解 CocoaPods 包管理器过程中所发现的 RCE 漏洞背后的研究过程与思路。 研究发布博文可在此阅读： https://www.evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods 研究背景 CocoaPods Trunk Server 充当 CocoaPods 的集中式存储库和分发平台，CocoaPods 是 Apple 生态系统中（尤其是 iOS 和 macOS 开发中）使用的重要库和框架。其主要目的是促进这些开源资源的无缝共享与管理。...

JFrog Artifactory 7.146.x < 7.146.36 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.146.x prior to 7.146.36. It is, therefore, affected by multiple vulnerabilities: - A user who can read an existing remote VCS repository can replace its configured origin or supply an...

CVE-2026-70548

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

CVE-2026-70548

This SSRF vulnerability affects JFrog Artifactory (Self-Managed) through its External Dependency feature related to CocoaPods . Under specific circumstances, a low-privilege user can issue requests to remote CocoaPods repositories, potentially leveraging Artifactory as a proxy. The CVSS v3.1 scor...

CVE-2026-70548 SSRF In CocoaPods Via JFrog Artifactory External Dependency

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

EUVD-2026-65543

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

Supply Chain Insecurity: Exposing Vulnerabilities in IOS Dependency Management Systems

Dependency management systems are a critical component in software development, enabling projects to incorporate existing functionality efficiently. However, misconfigurations and malicious actors in these systems pose severe security risks, leading to supply chain attacks. Despite the widespread...

Malicious code in cocoapod (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-192904 Malicious code in cocoapod (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

EUVD-2022-1732

Malicious code in bioql PyPI...

EUVD-2024-37282

Malicious code in bioql PyPI...

EUVD-2024-37281

Malicious code in bioql PyPI...

EUVD-2022-1661

Malicious code in bioql PyPI...

MAL-2025-1555 Malicious code in luno-cocoapods (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9bb59e6b577e1a28cf71bf254ef70a0641db3319c1985827f792edb51ea14493 The OpenSSF Package Analysis project identified 'luno-cocoapods' @ 2.8.0 rubygems as malicious. It is considered malicious because: - The packag...

Malicious code in luno-cocoapods (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9bb59e6b577e1a28cf71bf254ef70a0641db3319c1985827f792edb51ea14493 The OpenSSF Package Analysis project identified 'luno-cocoapods' @ 2.8.0 rubygems as malicious. It is considered malicious because: - The packag...

The vulnerability of the dependency manager for Swift and Objective-C CocoaPods exists due to the lack of measures taken to neutralize special elements, allowing attackers to execute arbitrary code.

The vulnerability of dependency managers for Swift and Objective-C CocoaPods exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of dependency managers for Swift and Objective-C CocoaPods, related to the provision of data elements during an erroneous session, allows a perpetrator to intercept the owner’s session and take control of another person’s CocoaPods trunk account.

The vulnerability of the dependency manager for Swift and Objective-C CocoaPods relates to the provision of data elements during an erroneous session. Exploiting this vulnerability can allow a remote attacker to intercept the user’s session and take control of their CocoaPods trunk account...

CVE-2024-38367

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of...

CVE-2024-38366

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX...

CVE-2024-38368

CVE-2024-38368 concerns CocoaPods trunk authentication server vulnerability where unclaimed pods could be claimed or where all owners could be removed, enabling takeover of pods migrated from the pre-2014 workflow to trunk. The issue stems from how ownership was managed on CocoaPods’ trunk server...