Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.7 · fleetdmNVD modified 2026-10-26 22:10
Affected (CPE criteria) 1
cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*