Homebrew 7.0.0 Patches Critical sudo Vulnerability and Enhances Security Features
Homebrew 7.0.0 addresses eight security advisories, including a critical flaw that allowed unsigned metadata to execute commands with sudo, and introduces new security scanning and provenance features.
The popular package manager Homebrew has released version 7.0.0, resolving a total of eight security advisories. The most critical of these vulnerabilities, rated High, allowed unsigned removal metadata for a Homebrew "cask" (a recipe for installing prebuilt applications) to execute commands with elevated privileges using sudo. This critical flaw was patched in version 6.0.12, but is now officially addressed in the 7.0.0 release.
Beyond the critical sudo vulnerability, Homebrew 7.0.0 also includes fixes for two Moderate and five Low severity advisories. One Moderate vulnerability, also fixed in 6.0.12, prevented the macOS installer from reading Git configuration files owned by the Homebrew prefix, which could have led to the execution of programs as root. The other Moderate issue, now addressed in 7.0.0, involved a LaunchServices escape that could allow malicious casks to execute code outside the macOS install sandbox.
The five Low severity advisories, resolved in earlier 6.0.x releases (6.0.6 and 6.0.7), addressed various issues related to unintended data access and potential exploitation. These included redirects that could expose secret headers or be leveraged for server-side request forgery, Git redirects that could bypass restrictions on third-party repositories (taps), Subversion URL manipulations that could be turned into command options, and patches that could write data outside of the intended staged source tree.
A significant new security feature introduced with Homebrew 7.0.0 is brew vulns. This command-line tool scans installed formulae (package definitions) against known vulnerabilities sourced from OSV.dev, a public index of open-source vulnerability records. This feature requires no additional taps or gems and can be narrowed by severity, dependencies, or available fixes, providing users with actionable security insights.
Underpinning brew vulns is a new advisory database that meticulously records vulnerabilities against specific Homebrew formula versions and revisions, including backported security fixes. This detailed tracking aims to reduce false alarms by accurately reflecting when a vulnerability has been patched, even if the upstream version number hasn't changed. The database adheres to the OSV format and is licensed under CC0, with findings published via Homebrew's formula API and as a downloadable index.
Homebrew has also expanded its provenance checks. While previously verifying build attestations for its own core tap, the project now extends this verification to supported third-party tap "bottles" (precompiled packages). Taps created using the brew tap-new command will publish these attestations by default, enhancing trust in the software supply chain.
Despite these enhancements, Homebrew acknowledges that sandboxing has limitations. "Sandboxing cannot make untrusted software safe to run," the project states, emphasizing that installed applications still run with user privileges, and vendor .pkg installers operate outside the sandbox and can request sudo. The release also notes the deprecation of old post-install and cask flight blocks in favor of declared steps, and a migration to a separate fetch phase for dependency downloads, after which installation proceeds with networking disabled and caches in read-only mode.
Finally, Homebrew has adjusted its support for Intel Macs and older macOS versions. Intel x86_64 architecture has moved to Tier 3 due to unreliable infrastructure for bottle builds, meaning updated formulae may require local compilation on Intel machines. Support for Intel Macs continues until September 1, 2027, with MacPorts suggested as an alternative. Similarly, macOS 10.15 and earlier are no longer supported, and macOS Sonoma 14 is also moved to Tier 3 without new bottle builds.