'Almost every Apple device' vulnerable to CocoaPods

Security researchers discovered a vulnerability in CocoaPods, an open-source dependency manager used in millions of iOS and macOS apps. The issue, known as CVE-2024-38368, allowed attackers to claim unowned Pods and insert malicious code. Another vulnerability, CVE-2024-38366, enabled remote code execution on the Trunk server. A third vulnerability, CVE-2024-38367, exploited email scanning software to steal session validation tokens. The researchers warned that almost every Pod owner was vulnerable to a zero-click takeover due to email security flaws. While there is no evidence of exploitation, the potential impact on the Apple ecosystem is significant. CocoaPods has since patched the vulnerabilities, but users are advised to review dependencies, validate code, and update installations. This incident underscores the risks associated with open-source dependencies and the importance of supply chain security in software development.