CVE-2022-24440

CVE-2022-24440 is a critical command injection vulnerability affecting cocoapods-downloader versions prior to 1.6.0, and specific versions 1.6.2 and 1.6.3. This flaw allows attackers to inject arbitrary commands via manipulated git and branch parameters when the Pod::Downloader.preprocess_options function is used with git. With a CVSS score of 9.8 (Critical), this vulnerability has a network attack vector, low attack complexity, and can lead to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, nor publicly available exploit code like Metasploit or ExploitDB modules, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.