← Vulnerability feed

Vulnerability record · CVE-2024-38367 · published 1 July 2024

CVE-2024-38367: Trunk.cocoapods.org vulnerability

Cocoapods · Trunk.Cocoapods.Org

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023.

9.6 CVSS 3.1 Critical EPSS 11% · top 4.2% CWE-488 · CWE-488
9.6CVSS 3.1 base score
11%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 Vendor Advisory
https://evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#vulnerability-3-achieving-zero-click-accou ExploitThird Party Advisory
https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-52gf-m7v9-m333 Third Party Advisory
https://github.com/CocoaPods/trunk.cocoapods.org/commit/d4fa66f49cedab449af9a56a21ab40697b9f7b97 Patch
https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 Vendor Advisory
https://evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#vulnerability-3-achieving-zero-click-accou ExploitThird Party Advisory
https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-52gf-m7v9-m333 Third Party Advisory
https://github.com/CocoaPods/trunk.cocoapods.org/commit/d4fa66f49cedab449af9a56a21ab40697b9f7b97 Patch

Track CVE-2024-38367 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-38366Trunk.cocoapods.org injection vulnerabilitytrunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real em…EPSS 18%9.3CVE-2024-38368Trunk.cocoapods.org exposure of resource to wrong sphere vulnerabilitytrunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the p…EPSS 15%

Source: NIST National Vulnerability Database (record CVE-2024-38367), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.