CVE-2026-53970

Name of the Vulnerable Software and Affected Versions ZeroBrew versions prior to 0.3.2

Description A missing integrity verification in the Ruby compatibility shim allows network attackers to execute arbitrary code. By substituting malicious content at formula resource or URL-based patch URLs, attackers can bypass checksum validation. This occurs when downloads for secondary resource and patch paths in shim.rb are intercepted or replaced, allowing the injection of attacker-controlled build steps or source tree modifications. These modifications execute during source builds performed via the zb install --build-from-source command without triggering an integrity warning.

Recommendations Update ZeroBrew to version 0.3.2 or later.