CyberRota Analysis
AI-GeneratedZeroBrew versions up to 0.3.1 are vulnerable due to a lack of integrity verification in the Ruby compatibility shim, allowing network attackers to execute arbitrary code by substituting malicious content in resource or patch URLs. This vulnerability enables attackers to intercept or replace downloads, potentially injecting harmful build steps during source installations without triggering any integrity warnings. Organizations using ZeroBrew should prioritize addressing this vulnerability to mitigate the risk of unauthorized code execution during software builds.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.