Description

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-14T16:16:57.073Z",
  "pubdate": "2026-08-14T16:16:57.073Z",
  "executiveSummary": "ZeroBrew version 0.3.1 and prior suffers from a missing integrity verification vulnerability residing within its Ruby compatibility shim component.\nThe flaw allows remote network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs that lack checksum validation.\nThe primary impact of this vulnerability is arbitrary code execution during source builds, compromising the integrity of the build environment and potentially leading to full system compromise.\nAffected systems include environments utilizing ZeroBrew version 0.3.1 and prior when performing source installations.\nThe risk implications are severe, as threat actors positioned on the network path can intercept or replace secondary resource and patch downloads without triggering any integrity warnings.\nAttacker capabilities include the ability to inject attacker-controlled build steps or source tree modifications that execute implicitly during the build process.\nExploitation requires the attacker to intercept or manipulate network traffic associated with formula resource or URL-based patch downloads when a user initiates a build operation.",
  "technicalDetails": "The vulnerability stems from the absence of cryptographic integrity verification mechanisms—such as checksum validation—within the Ruby compatibility shim of ZeroBrew.\nThe vulnerable component is identified as the shim.rb file, which handles the retrieval and processing of formula resources and URL-based patches.\nAffected versions are explicitly restricted to ZeroBrew version 0.3.1 and prior.\nThe root cause is the lack of mandatory hash checks (e.g., SHA-256) for secondary resource downloads and patch paths fetched over network protocols.\nNetwork exposure is present whenever downloads occur over unencrypted or interceptable channels where a network-positioned attacker can perform adversary-in-the-middle manipulations.\nAuthentication and privilege requirements depend on the execution context of the user, but typically do not require pre-existing authentication to intercept public or unvalidated download requests.\nThe step-by-step attack flow begins when a user invokes the zb install --build-from-source command.\nDuring the execution of this command, the vulnerable shim.rb script initiates downloads for secondary resources or URL-based patches.\nAn attacker positioned on the network intercepts these HTTP or unvalidated download requests.\nThe attacker substitutes the legitimate resource or patch content with malicious payloads.\nBecause shim.rb fails to perform checksum validation or integrity verification on the downloaded files, the modified content is accepted without generating any warnings or errors.\nThe payload behavior involves injecting attacker-controlled build steps or direct modifications into the source tree.\nPost-exploitation impact is realized when the malicious build steps or modified source tree execute automatically during the compilation and installation phase invoked by the user, leading to arbitrary code execution within the context of the running build process."
}