title

Remote code execution in Homebrew by compromising the official Cask repository - RyotaK's Blog

charset

utf-8

viewport

width=device-width,initial-scale=1,shrink-to-fit=no

HandheldFriendly

True

X-UA-Compatible

IE=edge

og:title

Remote code execution in Homebrew by compromising the official Cask repository

og:type

article

og:url

https://web.archive.org/web/20250504054045/https://blog.ryotak.net/post/homebrew-security-incident-en/

og:description

この記事は日本語でも投稿されています: https://blog.ryotak.net/post/homebrew-security-incident/ (もし日本語が読める場合、筆者は英語がそこまで得意ではないため、日本語の記事を読むことをお勧めします。) (Official blog post about this incident is available here: https://brew.sh/2021/04/21/security-incident-disclosure/) Preface Homebrew project is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform the vulnerability assessment. This article describes a vulnerability assessment that is performed with permission from the Homebrew project’s staff and is not intended to recommend you to perform an unauthorized vulnerability assessment. If you found any vulnerabilities in Homebrew, please report it to Homebrew project’s vulnerability disclosure program.

og:image

https://web.archive.org/web/20250504054045im_/https://blog.ryotak.net/img/og.webp

twitter:title

Remote code execution in Homebrew by compromising the official Cask repository

twitter:description

この記事は日本語でも投稿されています: https://blog.ryotak.net/post/homebrew-security-incident/ (もし日本語が読める場合、筆者は英語がそこまで得意ではないため、日本語の記事を読むことをお勧めします。) (Official blog post about this incident is available here: https://brew.sh/2021/04/21/security-incident-disclosure/) Preface Homebrew project is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform the vulnerability assessment. This article describes a vulnerability assessment that is performed with permission from the Homebrew project’s staff and is not intended to recommend you to perform an unauthorized vulnerability assessment. If you found any vulnerabilities in Homebrew, please report it to Homebrew project’s vulnerability disclosure program.

twitter:card

summary

twitter:image

https://web.archive.org/web/20250504054045im_/https://blog.ryotak.net/img/og.webp

apple-touch-icon

/web/20250504054045im_/https://blog.ryotak.net/apple-touch-icon.png

icon

/web/20250504054045im_/https://blog.ryotak.net/favicon-32x32.png

icon

/web/20250504054045im_/https://blog.ryotak.net/favicon-16x16.png

manifest

/web/20250504054045/https://blog.ryotak.net/site.webmanifest

stylesheet

https://web-static.archive.org/_static/css/banner-styles.css?v=p7PEIJWi