CVE-2026-53970

Published: Ago 14, 2026 Last Modified: Ago 14, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: active
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.

494

Download of Code Without Integrity Check

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Confidentiality Other
Potential Impacts:
Execute Unauthorized Code Or Commands Alter Execution Logic Other
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
https://github.com/lucasgelfond/zerobrew
https://github.com/lucasgelfond/zerobrew
https://github.com/lucasgelfond/zerobrew/commit/89a60b73c7e…
https://github.com/lucasgelfond/zerobrew/commit/89a60b73c7edd6b662e2a085be3d981…
https://www.vulncheck.com/advisories/zerobrew-version-and-p…
https://www.vulncheck.com/advisories/zerobrew-version-and-prior-missing-checksu…