What’s Vulnerable › Vulnerabilities

CVE-2026-53970: ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-14 · updated 2026-09-24
• Weakness: CWE-494

Description

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.

Affected products

• lucasgelfond ZeroBrew: through 0.3.1

References

• https://github.com/lucasgelfond/zerobrew
• https://github.com/lucasgelfond/zerobrew/commit/89a60b73c7edd6b662e2a085be3d981b6ebeb1aa
• https://www.vulncheck.com/advisories/zerobrew-version-and-prior-missing-checksum-verification-rce-via-shim-rb

Get alerted when CVE-2026-53970 or the next vulnerability affects your stack