CVE-2024-38368
criticaltrunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager.
Vendor / product: Cocoapods — trunk.cocoapods.org
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.
CVSS
9.3
9.3 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2024-07-01 21:15
Modified: 2026-11-03 22:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-11-03 22:24 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
cocoapods / trunk.cocoapods.org <2023-09-22
Weakness classification (CWE)
CWE-668 NVD-CWE-noinfo
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023
Vendor advisory: https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023
References
- https://blog.cocoapods.org/Claim-Your-Pods security-advisories@github.com
- https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 security-advisories@github.com
- https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-ta... security-advisories@github.com
- https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx security-advisories@github.com
- https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec3336... security-advisories@github.com
- https://blog.cocoapods.org/Claim-Your-Pods af854a3a-2127-422b-91ae-364da2661108
- https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 af854a3a-2127-422b-91ae-364da2661108
- https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-ta... af854a3a-2127-422b-91ae-364da2661108
- https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx af854a3a-2127-422b-91ae-364da2661108
- https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec3336... af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 22:24 UTC · record ↗