CVE-2026-53970: Lucasgelfond Zerobrew

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.

Affected products

• Lucasgelfond Zerobrew: up to and including 0.3.1

Published 2026-08-14. Last modified 2026-09-24.