Critical Vulnerability in Swift Library CocoaPods: Threat to iOS and macOS

Online Python Trainer for Beginners

Learn Python easily without overwhelming theory. Solve practical tasks with automatic checking, get hints in Russian, and write code directly in your browser — no installation required.

Start Course

Critical Vulnerability in Popular Swift Library: Thousands of iOS and macOS Apps at Risk

Cybersecurity experts from E.V.A Information Security have discovered a critical vulnerability in the dependency manager CocoaPods — one of the most popular libraries for Swift and Objective-C languages used in development for iOS, macOS, tvOS, and watchOS. The issue has been assigned the identifier CVE-2024-38367 and a score of 9.1 points on the CVSS v3 scale, classifying it as critical.

Nature of the Problem

The vulnerability affects the authentication and package verification mechanism in the CocoaPods registry. An attacker exploiting this flaw can:

Upload malicious code to the official repository disguised as a legitimate update to a popular library (e.g., Alamofire, Firebase, Kingfisher).
Execute arbitrary code on the user's device when building or running an application that uses the compromised dependency.
Gain access to sensitive data: encryption keys, authorization tokens, user information.

What makes this particularly dangerous is that the attack can be carried out without the developer's knowledge — it is enough to update the Podfile once or run pod install.

Affected Versions

According to the official security bulletin, the vulnerability is present in all versions of CocoaPods up to and including 1.15.2. The fix has been released in version 1.16.0.

How to Protect Yourself?

Developers and project administrators are advised to take the following steps immediately:

Update CocoaPods to version 1.16.0 or higher: sudo gem update cocoapods.
Verify the integrity of the Pod files in use — compare checksums with the official ones.
Rebuild and resubmit applications to the App Store and Mac App Store with the new version of the manager.
Code audit — check projects for suspicious or undocumented dependencies.

Community Response

The CocoaPods team promptly released a patch and published a detailed vulnerability report. Developers are strongly advised not to delay the update — according to analysts, up to 70% of commercial iOS applications use CocoaPods, making the attack widespread.

Please note that this news is for informational purposes. For the latest updates, follow the official CocoaPods repository on GitHub and CVE bulletins.