CVE-2026-34387
Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
Summary
Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
Original description
The description as published by the source.
Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov