Fleet's installer pipeline incorrectly incorporates untrusted metadata into uninstall scripts. A malicious package can embed crafted values that cause the generated script to execute arbitrary commands when a user triggers an uninstall. The script runs with the system account on the managed endpoint (root on macOS/Linux, SYSTEM on Windows), allowing an attacker to gain full control of the device. This flaw is an instance of OS command injection (CWE‑78).

The flaw affects customers using Fleet open‑source device management software prior to version 4.81.0. Both macOS and Linux endpoints are vulnerable when uninstalls are performed, and Windows devices are impacted if the uninstall script is executed under the SYSTEM account. Any installation of software packages with unsafe metadata—such as .pkg, .deb, .rpm, .exe, or .msi files—can trigger the vulnerability in these affected versions.

The CVSS v3 score of 6 indicates a moderate severity. The EPSS value is unavailable, but the vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation. An attacker would need to craft a malicious package and upload it to a Fleet server that manages the target endpoint. Once the uninstall is triggered—either manually, through an update cycle, or via the automatic uninstall script—the attacker’s commands execute with elevated privileges. Because the attack requires a managed device to undergo an uninstall, the attack surface is limited to environments using Fleet before the fixed release. Until an upgrade is applied, administrators should block the upload of packages from untrusted sources and review or edit generated uninstall scripts.