CVE-2026-53970

Katalog CVE

CVSS 7.5 · High EPSS 0,25%

Kerentanan Download of Code Without Integrity Check. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.

Rincian

Terbit di NVD

14 Agustus 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-494: Download of Code Without Integrity Check

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/lucasgelfond/zerobrew
• https://github.com/lucasgelfond/zerobrew/commit/89a60b73c7edd6b662e2a085be3d981b6ebeb1aa
• https://www.vulncheck.com/advisories/zerobrew-version-and-prior-missing-checksum-verification-rce-via-shim-rb