Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

homebrew/brew

              main @ 988a7ca
            

Fixes

CVEs

HIGH

Peak severity

28.1%

Coverage

Highlights

Privilege Escalation: 9 prior fixes. Scrutinize any change in this area.

Library/Homebrew/system_command.rb: most-fixed (6 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Subprocess invocation routinely fell back to shell execution when handling binary names with spaces or unescaped arguments, leading to arbitrary shell evaluation in the context of the running command. This was resolved by forcing array-based argv passing to Open3.popen3 and escaping execution targets.

Privilege Escalation: Unsafe handling of the package-user plist allowed local attackers to escalate privileges. Remediation introduced strict ownership checks (root-only), file mode validation (0600), non-symlink verification, and ACL rejection before executing subprocesses.

Code Execution: The use of Ruby's Marshal serialization to communicate child process errors across fork boundaries allowed arbitrary code execution outside the build sandbox during deserialization. This was resolved by replacing Marshal with JSON serialization.