https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T21:47:59.943961+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2022-21223 CVE-2022-21223 — Command Injection 2026-10-05T21:47:59.959595+00:00

Affected: cocoapods-downloader

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.