CVE-2024-38366

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk.

• CWE-74
• CWE-74

• https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023Vendor Advisory
• https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-the-cocoapods-trunk-serverExploit, Third Party Advisory
• https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-x2x4-g675-qg7cThird Party Advisory
• https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023Vendor Advisory
• https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-the-cocoapods-trunk-serverExploit, Third Party Advisory
• https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-x2x4-g675-qg7cThird Party Advisory

Published

Jul 1, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-38359The Lightning Network Daemon (lnd) - is a complete implement…6.5
• CVE-2024-38360Discourse is an open source platform for community discussio…4.9
• CVE-2024-38361Spicedb is an Open Source, Google Zanzibar-inspired permissi…5.3
• CVE-2024-38363Airbyte is a data integration platform for ELT pipelines. Ai…8.5
• CVE-2024-38364DSpace is an open source software is a turnkey repository ap…2.6
• CVE-2024-38365btcd is an alternative full node bitcoin implementation writ…8.1
• CVE-2024-38367trunk.cocoapods.org is the authentication server for the Coa…9.6
• CVE-2024-38368trunk.cocoapods.org is the authentication server for the Coa…9.3
• CVE-2024-38369XWiki Platform is a generic wiki platform offering runtime s…4.3
• CVE-2024-3837Use after free in QUIC in Google Chrome prior to 124.0.6367.…8.8
• CVE-2024-38370GLPI is a free asset and IT management software package. Sta…7.5
• CVE-2024-38371authentik is an open-source Identity Provider. Access restri…9.8