CVE-2026-53970

High

Description

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.

SeverityHigh

CVSS7.5

Exploit probability—

ProductZeroBrew

PublishedAug 14, 2026

First seenAug 14, 2026

Weakness typeCWE-494CWE-494

How to fix

Patches

github.com/lucasgelfond/zerobrew/commit/89a60b73c7edd6b662e2a085be3d981b6ebeb1aa

Affected products

Product	Affected versions	Fixed in
lucasgelfond ZeroBrew	v ≤ 0.3.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.