Homebrew 7.0.0 Closes Eight Advisories, Including a Cask Flaw That Reached sudo, and Adds a Built-In Vulnerability Scanner
Published on gastropod.io on 09-17-2026
Homebrew 7.0.0 Closes Eight Advisories, Including a Cask Flaw That Reached sudo, and Adds a Built-In Vulnerability Scanner
Tags: vulnerability-intelligence, software-supply-chain-security, homebrew, macos, osv, developer-workstations
Homebrew released version 7.0.0 on September 13 (Homebrew). Homebrew installs command-line tools and desktop applications on macOS and Linux, and most Mac developers use it to set up their machines. The release completes fixes for eight security advisories: one rated High, two Moderate, and five Low.
The High advisory, GHSA-rg9r-ppxp-87hm, fixed in 6.0.12, let unsigned cask-removal metadata execute commands with sudo. A cask is Homebrew's definition for installing a prebuilt application. Homebrew deleted the vulnerable recovery code and the API accessors that reached it. The two Moderate advisories cover a macOS installer that read Git configuration owned by the Homebrew prefix, which could execute programs as root (fixed in 6.0.12), and a path that let a malicious cask execute code outside the macOS install sandbox through LaunchServices (fixed in 7.0.0). The five Low advisories, fixed in 6.0.6 and 6.0.7, cover redirects that could send secret headers to another host or be used for server-side request forgery, Git redirects that could bypass tap restrictions, Subversion URLs that could be interpreted as command options, and patches that could write outside the staged source tree (Help Net Security).
Machines that auto-update already have the seven fixes from 6.0.x. The LaunchServices fix requires 7.0.0. Homebrew states in its release that sandboxing cannot make untrusted software safe to run. An installed application runs with the user's privileges, and vendor .pkg installers run outside the sandbox and can request sudo. Trust in the tap that supplies a cask remains the main protection.
The release also changes how installs run. Homebrew now sandboxes formula and cask operations, delivers setup instructions as signed data instead of arbitrary Ruby, and deprecates the old post_install and cask flight blocks. Official taps already reject those blocks, and third-party taps can use them until December 11, 2027. Builds no longer read the home directory by default. Homebrew is also moving dependency downloads into a separate fetch phase, after which installation runs with networking disabled and caches read-only; that migration is still in progress. On Linux, Landlock replaces the Bubblewrap sandbox introduced in June.
brew vulns is now built in. It checks installed formulae, a named formula, or the formulae in a Brewfile against a new Homebrew advisory database built on OSV data. The database records vulnerabilities against the formula versions and revisions Homebrew ships, including security patches Homebrew backports without changing the upstream version number (BleepingComputer). A scanner that matches only on the upstream version string reports those backported flaws as open. Homebrew also now verifies build attestations for supported third-party tap bottles, and taps created with brew tap-new publish attestations by default.
The backport problem applies well beyond Homebrew. Linux distributions, vendors, and maintainers ship fixed builds under version strings that match vulnerable ones, and a name-and-version match reports the wrong answer in both directions. The fastjson 1.2.83 and 1.2.83_noneautotype builds are an example I have already covered here: https://gastropod.io/news/no-patch-for-fastjson-1-x-cve-2026-16723-is-an-inventory-problem-to-solve.
Sources: