The vulnerability is a command injection that occurs when an uninstall script is processed for a deliberately crafted software package. The pipeline allows arbitrary commands to be executed, giving an attacker root privileges on macOS/Linux or SYSTEM privileges on Windows devices. This translates into complete control over the affected host and a significant breach of confidentiality, integrity, and availability. The weakness is a classic command injection (CWE‑78).

The affected product is Fleet by fleetdm. Versions prior to 4.81.1 are vulnerable. The issue is found in the software installer module that handles uninstall scripts for managed machines. No other vendors or products are affected according to the advisory.

The CVSS score of 5.7 indicates medium severity, and although an EPSS score is not available, the vulnerability can be exploited once a crafted package reaches the installer. The weakness allows privileged code execution, so a successful exploit would compromise an entire device. Because a managed host normally executes code from the Fleet agent, an attacker who can upload or trigger a malicious uninstall may gain full control. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild.