Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck

CVE-2026-53970ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb

High 7.5

In plain English

A high-severity security flaw in ZeroBrew from lucasgelfond. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 82.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.

Affected products (as reported)

Vendor	Product	Versions
lucasgelfond	ZeroBrew	0 – through 0.3.1

Weakness: CWE-494 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Product Repository issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/zerobrew-version-and-prior-missing-checksum-verification-rce-via-shim-rb third-party-advisory