Zerobrew
Monthly
Remote code execution in ZeroBrew 0.3.1 and prior exploits the absence of SHA-256 checksum validation in the Ruby compatibility shim (shim.rb), enabling a network-positioned attacker to substitute malicious archives or patch files during source builds. The attack surface is specifically the 'zb install --build-from-source' workflow, where secondary resource downloads and URL-based patch fetches proceed without any integrity check, allowing attacker-controlled content to execute arbitrary build steps. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-confirmed patch v0.3.2, released 2026-06-11, closes the gap by adding pre-extraction SHA-256 verification.
Remote code execution in ZeroBrew 0.3.1 and prior exploits the absence of SHA-256 checksum validation in the Ruby compatibility shim (shim.rb), enabling a network-positioned attacker to substitute malicious archives or patch files during source builds. The attack surface is specifically the 'zb install --build-from-source' workflow, where secondary resource downloads and URL-based patch fetches proceed without any integrity check, allowing attacker-controlled content to execute arbitrary build steps. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-confirmed patch v0.3.2, released 2026-06-11, closes the gap by adding pre-extraction SHA-256 verification.