### [CVE-2022-21223](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21223)
![](https://img.shields.io/static/v1?label=Product&message=cocoapods-downloader&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%201.6.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brighgreen)

### Description

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

### POC

#### Reference
- https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414280
- https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414280

#### Github
- https://github.com/dellalibera/dellalibera