CVE-2026-53970

The vulnerability lives in shim.rb, ZeroBrew's Ruby compatibility layer. When users run `zb install --build-from-source`, the tool fetches external resources without checksum validation — any compromise of the download channel (mirror compromise, man-in-the-middle, compromised secondary host) leads to arbitrary code execution on the developer's machine. The CVSS 7.5 reflects the accessible threat model: network-available, low-complexity, no privilege required. That's a permissive profile for a supply chain component used by power users and CI pipelines. But the deeper problem isn't the missing checksum — it's why that gap existed in the first place. Compatibility shims occupy a dangerous security position: they're written quickly to achieve migration goals, framed as transitional, and treated as time-limited code that will eventually be deprecated. That framing creates a structural blind spot. Security scanners frequently exclude 'compat', 'legacy', or 'shim' directories by default. Linters skip files with these markers. CI pipelines apply different thresholds to bridging code. The shim sits at a translation boundary — converting inputs from external resource networks into the trusted core's execution context — but because it's conceptually peripheral, it never received the scrutiny that core logic would have. The 'build-from-source' trust inversion makes this worse. Users opt into this mode precisely because they want verifiability and control. The tool's architecture assumes that retrieving source equals safety — a pre-supply-chain-attack era assumption. Attackers target the paths users believe are safest because that's where defensive attention concentrates. Compromising this mode gives code execution on machines feeding artifacts into production systems. This pattern has genealogy: Python's setuptools shims (CVE-2016-1000051), Node's polyfill ecosystem, Java's JDK compatibility layers — each post-mortem identical: 'we treated it as transitional.' The institutional memory evaporates while the structural conditions persist. Check your ZeroBrew installation for other shims, adapters, and bridging layers — Python shims, shell adapters, build system wrappers. The same conditions that produced this CVE likely exist elsewhere in the codebase. Treat transitional code with the same patch priority as core logic; the 'temporary' framing is itself a source of accumulated security debt that never gets serviced.

Reviewed through automated stages and approved by a human before publication.