CVE-2026-53970

HighCVSS 7.5

Published: 14/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

ZeroBrew version 0.3.1 and prior has a missing integrity verification vulnerability in the Ruby compatibility shim. Network attackers can substitute malicious content at formula resource or URL-based patch URLs, executing arbitrary code during source builds.

Risk Assessment

An attacker can intercept or replace downloaded files, potentially leading to execution of malicious code on the user's system.

Recommendation

It is recommended to upgrade ZeroBrew to the latest version and avoid installing from sources from untrusted origins.

Original NVD description (English source)

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.