CVE-2024-38366
The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 17.8%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk.
- CVSS 3.1
- 10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 17.79% probability · 97th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- cocoapods/trunk.cocoapods.org
- Source
- security-advisories@github.com
EPSS 17.8% since 3 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023Vendor Advisory
- https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-the-cocoapods-trunk-serverExploit, Third Party Advisory
- https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-x2x4-g675-qg7cThird Party Advisory
- https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023Vendor Advisory
- https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-the-cocoapods-trunk-serverExploit, Third Party Advisory
- https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-x2x4-g675-qg7cThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.