cocoapods

CocoaPods Orphaned Pods and RCE Vulnerabilities

EVA Information Security discovered three critical CocoaPods vulnerabilities that had existed for nearly a decade. The flaws allowed orphaned package takeover, Trunk server code execution through email validation, and zero-click account takeover. Because CocoaPods sits under a vast iOS and macOS dependency graph, exploitation could have redirected trusted mobile builds at registry scale.