Homebrew 7.0.0 Fixes Eight Security Issues and Adds Vulnerability Scanning
Summary
Homebrew 7.0.0 closes eight security advisories, adds the brew vulns scanner using OSV[.]dev records, and expands provenance checks and sandboxing across macOS and Linux.
Key points
- The release closes eight security advisories: one rated High, two Moderate, and five Low.
- A High-severity issue allowed unsigned cask removal metadata to run commands with sudo; it was fixed in Homebrew 6.0.12.
- A Moderate issue fixed in 7.0.0 let a malicious cask escape the macOS install sandbox through LaunchServices.
- The new brew vulns command checks installed formulae against OSV[.]dev records, including Homebrew-specific versions and backported fixes.
- Homebrew expands build-attestation checks to supported third-party taps and enables attestations by default for taps created with brew tap-new.
- Version 7.0.0 tightens installation sandboxing; Linux uses Landlock where supported, while systems without it retain a less secure configuration.
- Intel Macs move to Tier 3, and Homebrew says support will end on 1 September 2027.
Article Details
- Event Type
- Software security release
- Impact
- Homebrew 7.0.0 closes eight security advisories, including a High-severity flaw that allowed unsigned cask removal metadata to execute commands with sudo and a Moderate issue that let a malicious cask escape the macOS installation sandbox through LaunchServices. The release adds the brew vulns vulnerability scanner and expands provenance checks and sandboxing.
Products
BubblewrapOn Linux, Homebrew replaces the Bubblewrap sandboxing introduced in June with Landlock, a kernel facility that needs no dependencies or escalated Docker permissions.HomebrewHomebrew 7.0.0 closes eight security advisories, including a High-severity flaw that could let unsigned cask removal metadata run commands with sudo and a Moderate issue involving LaunchServices sandbox escape.LandlockOn Linux, Homebrew replaces the Bubblewrap sandboxing introduced in June with Landlock, a kernel facility that needs no dependencies or escalated Docker permissions.LaunchServicesHomebrew 7.0.0 closes eight security advisories, including a High-severity flaw that could let unsigned cask removal metadata run commands with sudo and a Moderate issue involving LaunchServices sandbox escape.LinuxThe release also adds built-in vulnerability scanning with brew vulns, expands provenance checks, and tightens sandboxing across macOS and Linux.macOSThe release also adds built-in vulnerability scanning with brew vulns, expands provenance checks, and tightens sandboxing across macOS and Linux.MacPortsHomebrew runs on Intel until 1 September 2027 without project support, and its suggestion for those users is a different package manager, MacPorts.OSV.dev#Homebrew #LaunchServices #OSV.dev