CVE-2026-34387
Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
概要
Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov