Apple CocoaPods Bugs Expose Millions of Apps to Code Injection

E.V.A Information Security found several critical vulnerabilities in CocoaPods' Trunk service — notably a CVE-2024-38366 RCE via a vulnerable RubyGem and bugs allowing orphaned pod takeover and session hijacking — that potentially allowed attackers to modify or inject malicious code into widely used iOS/macOS libraries; the flaws date back to a 2014 migration and could have affected thousands of pods and millions of apps, though CocoaPods patched the issues in October and there is no clear evidence of exploitation in the wild.