brew
7.0.13🍺 The Package Manager for Everywhere
- Maintenance
- Active1807 commits in 3 months · bus factor 4
- License
- BSD-2-ClausePermissive · OSI-approved
- Security
- 16 advisories2 high, 6 medium, 8 low · Scorecard 5.9/10
- Supported versions
- No scheduleendoflife.date does not track this project
50.3k stars · 11.4k forks · 20 open issues · last release 6 days ago · data checked 3 hours ago
Security advisories
All advisories on GitHubThe 16 most recent advisories published by the maintainers: 2 high, 6 medium, 8 low. Check the patched version against the one you run.
- mediumGHSA-xmf2-2c85-wgrgNov 10, 2026GitHub API token exposed in curl process arguments to other local users
- Affected
- <7.0.13
- Patched in
- 7.0.13
- mediumGHSA-8rrh-86hp-m68gOct 26, 2026`brew info <user>/<tap>/<formula>` silently executes untrusted tap Ruby — bypass of the documented Tap-Trust load boundary
- Affected
- >= 6.0.0 (verified 6.0.22 and 7.0.10; present on main 2026-10-24)
- Patched in
- 7.0.11
- highGHSA-wh9r-xjmq-6v2hSep 17, 2026pkg postinstall executes programs from prefix-owned .git/config as root
- Affected
- >= 5.1.8, <= 7.0.3
- Patched in
- 7.0.4
- lowGHSA-7hjr-9j5m-v2hwSep 17, 2026Cask `rename` stanza is not confined to the staged tree — arbitrary file move via `brew install --cask`
- Affected
- <= 7.0.3-18-gd7cca49
- Patched in
- 7.0.4
- mediumGHSA-ccgw-4xcq-vgr6Sep 15, 2026macOS Sandbox escape through TOCTOU on homebrew.sb and payload.json files
- Affected
- <= 7.0.1
- Patched in
- 7.0.2
- mediumGHSA-5263-whxq-77hpSep 13, 2026Cask install sandbox escape via LaunchServices: unsandboxed code execution when installing a malicious cask
- Affected
- <=6.0.22
- Patched in
- 7.0.0
- mediumGHSA-hqpg-hjr9-c7j8Sep 5, 2026Regression in the GHSA-6689-q779-c33m fix: pkg `postinstall` reads a prefix-owned `.gitconfig` as root, and `core.hooksPath` does not cover config-specified programs
- Affected
- >= 5.1.8
- Patched in
- 6.0.12
- highGHSA-rg9r-ppxp-87hmSep 5, 2026Installed-cask uninstall/zap artifact recovery reads the unsigned `cask/<token>.json` endpoint, bypassing JWS verification and reaching `sudo` command execution
- Affected
- 6.0.11
- Patched in
- 6.0.12
- lowGHSA-3m5g-jfx7-3p65Jul 6, 2026Deferred `HOMEBREW_` secret in a download header is re-sent to an attacker host on a cross-host download redirect
- Affected
- validated at c0ed315adb
- Patched in
- 6.0.7
- lowGHSA-9g4r-vmj2-j2gjJul 6, 2026Server-supplied `svn:externals` URL reaches `svn checkout` in option position (argument injection, no malicious formula)
- Affected
- Tested on c0ed315adb (5.1.15-619)
- Patched in
- 6.0.7
- lowGHSA-x82f-cj53-gqfrJul 6, 2026`brew livecheck` follows a server-supplied redirect to an internal/loopback (or non-HTTPS) target — SSRF (no `--proto-redir` restriction by default)
- Affected
- All released versions through HEAD `09f982d0`
- Patched in
- 6.0.7
- lowGHSA-r9gp-p4vv-f93xJul 4, 2026Server-supplied git redirect silently retargets a tap's origin to an attacker on a routine brew update (HOMEBREW_ALLOWED_TAPS bypass)
- Affected
- commit 1717af5d68
- Patched in
- 6.0.6
- lowGHSA-r7qx-325v-4ccxJul 4, 2026Incomplete `ensure_targets_within!` (#22466): a server-supplied `Index:`-header patch bypasses the staged-tree containment and writes out-of-tree (sandbox-contained on macOS)
- Affected
- validated at c0ed315adb = 5.1.15-619
- Patched in
- 6.0.6
- lowGHSA-59v8-x8q4-px5cJun 10, 2026Homebrew macOS installer package trusts user-controlled `/var/tmp` plist and can assign Homebrew ownership to a local attacker
- Affected
- Homebrew 5.1.15-106-gaf69e65
- Patched in
- 6.0.0
- lowGHSA-7699-qf8c-q47mMay 21, 2026POST download strategy bypasses documented HTTPS-to-HTTP redirect protection by discarding `resolved_url`
- Affected
- <= 5.1.12
- Patched in
- 5.1.13
- mediumGHSA-6689-q779-c33mApr 27, 2026Root Code Execution via Git Hooks in macOS `.pkg` Postinstall
- Affected
- 5.1.6
- Patched in
- 5.1.8