Which versions of ZeroBrew are affected by EUVD-2026-58684?

ZeroBrew versions 0.3.1 and prior contain a remote code execution vulnerability in build installations that allows network attackers to inject malicious code into software artifacts by bypassing…. A patch is available.

How to fix or mitigate EUVD-2026-58684?

Within 24 hours, inventory all systems running ZeroBrew versions 0.3.1 or earlier, prioritizing CI/CD pipelines that use the '--build-from-source' workflow. Within 7 days, upgrade all affected installations to ZeroBrew version 0.3.2 or later, which adds mandatory SHA-256 checksum validation for all downloaded resources. Within 30 days, conduct a security audit of all build artifacts and production deployments generated during the vulnerability window to confirm no malicious code was introduced, and implement network access controls restricting build processes to approved artifact repositories only.

ZeroBrew EUVD-2026-58684

Q: What is the CVSS score of EUVD-2026-58684?

EUVD-2026-58684 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-53970 HIGH

Download of Code Without Integrity Check (CWE-494)

2026-08-14 VulnCheck

GHSA-9pp6-v7j8-j65j

RCE Zerobrew

7.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network MitM required for substitution (AV:N/AC:H), no privileges on target needed (PR:N), but victim must actively trigger a source build (UI:R); all three impact axes high because attacker controls build execution and output artifacts.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 14, 2026 - 16:01 vuln.today

Analysis Generated

Aug 14, 2026 - 16:01 vuln.today

CVE Published

Aug 14, 2026 - 15:32 cve.org

HIGH 7.5

DescriptionCVE.org

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.

AnalysisAI

Remote code execution in ZeroBrew 0.3.1 and prior exploits the absence of SHA-256 checksum validation in the Ruby compatibility shim (shim.rb), enabling a network-positioned attacker to substitute malicious archives or patch files during source builds. The attack surface is specifically the 'zb install --build-from-source' workflow, where secondary resource downloads and URL-based patch fetches proceed without any integrity check, allowing attacker-controlled content to execute arbitrary build steps. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-confirmed patch v0.3.2, released 2026-06-11, closes the gap by adding pre-extraction SHA-256 verification.

Technical ContextAI

ZeroBrew (CPE: cpe:2.3:a:lucasgelfond:zerobrew:*:*:*:*:*:*:*:*) is a package manager that implements a Homebrew-compatible Ruby formula shim (shim.rb) enabling formula-defined source builds. The vulnerable code path resides in zb_io/src/build/executor.rs, which generates and executes the shim at build time. CWE-494 (Download of Code Without Integrity Check) is the precise root cause: the executor fetched formula resources and URL-based patch archives over the network and passed them directly to extraction and application routines without computing or comparing any cryptographic digest. The fix in commit 89a60b73 introduces a sha256_hex_file() function using the sha2 crate, wires it into the download pipeline, and enforces rejection on mismatch before any extraction occurs - confirmed by two new integration tests (run_build_rejects_resource_checksum_mismatch and run_build_accepts_matching_resource_checksum).

RemediationAI

Upgrade ZeroBrew to version 0.3.2 or later; this is the sole complete fix, confirmed by the vendor CHANGELOG entry ('Verify SHA-256 checksums for resource and URL patch downloads in the formula build shim before extraction or application') and the patch commit at https://github.com/lucasgelfond/zerobrew/commit/89a60b73c7edd6b662e2a085be3d981b6ebeb1aa. If an immediate upgrade is not feasible, stop using the '--build-from-source' flag entirely and restrict installs to pre-built bottles, which do not exercise the vulnerable shim code path; the trade-off is that source-only or custom formulae will be unavailable. As an additional compensating control, route all formula resource downloads through an internal artifact proxy that enforces its own checksum policy (e.g., Artifactory or Nexus with integrity enforcement enabled), reducing MitM exposure, though this does not fix the client-side absence of verification and should not substitute for patching.