ZeroBrew versions 0.3.1 and earlier lack integrity verification in the Ruby compatibility shim. This flaw allows attackers who can intercept or substitute formula or patch URLs to inject malicious build steps or source modifications that run during a source build, leading to arbitrary code execution without any warning. The vulnerability is a classic example of a checksum missing (CWE‑494) flaw that removes a fundamental trust boundary between the package installer and the local system.

The affected vendor is Lucas Gelfond’s ZeroBrew. All iterations up to and including version 0.3.1 are impacted because they do not validate checksums for resources fetched via shim.rb. No specific operating system or platform is mentioned; the flaw exists in the Ruby script that is executed during the install process, so any environment where ZeroBrew can be run with network access to external formulae is at risk.

The CVSS score of 7.5 indicates high impact and a medium-to-high likelihood of exploitation. Because EPSS information is not available, the precise market exploitation probability is unknown, but the flaw is reachable by network attackers capable of controlling URL responses. Since the vulnerability is not listed in the CISA KEV catalog, no large‑scale exploits have been documented yet, but the lack of checksum verification makes it an attractive vector for targeted attacks or supply‑chain compromises. The attack path requires that the attacker can influence the URL providing the formula or patch; once the malicious content is served, the 'zb install --build-from-source' command will execute the injected code on the victim’s machine.