CVE-2026-53970: ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb
ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZeroBrewto a version that resolves this vulnerability.Fixed in 0.3.1 - Compensating control
For ZeroBrew source builds using 'zb install --build-from-source', mitigate missing integrity checking by preventing network attackers from substituting malicious formula resource content and URL-based patch downloads (e.g., restrict outbound access and/or ensure downloads are retrieved only from trusted sources).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53970?
CVE-2026-53970 has a severity rating of high, with a CVSS score of 7.5.
How do I fix CVE-2026-53970?
To fix CVE-2026-53970, upgrade to ZeroBrew version 0.3.2 or later, which includes the necessary checksum verification.
What types of attacks are possible with CVE-2026-53970?
CVE-2026-53970 allows network attackers to execute arbitrary code by injecting malicious content into the application.
Which versions of ZeroBrew are affected by CVE-2026-53970?
CVE-2026-53970 affects ZeroBrew version 0.3.1 and all prior versions.
Is user interaction required to exploit CVE-2026-53970?
Yes, CVE-2026-53970 requires user interaction, as it exploits URLs that a user must interact with.