Fleet’s installer pipeline contains a command‑injection flaw in uninstall scripts for software packages. A specially crafted package can cause arbitrary shell commands to run with host‑level privileges after the uninstall completes. On macOS and Linux the code runs as root; on Windows it runs as SYSTEM, giving the attacker full control of the managed device. This is a CWE‑78 vulnerability.

The flaw affects the open‑source Fleet device‑management platform from fleetdm. Versions prior to 4.81.1 are vulnerable. Any host on which Fleet processes uninstall scripts for a malicious package – including macOS, Linux and Windows devices – is at risk.

The CVSS base score is 5.7, indicating moderate severity. EPSS is below 1 % and the CVE is not listed in CISA’s KEV catalog, so large‑scale exploitation is unlikely but not impossible. The likely attack vector requires an attacker to supply a crafted package to a Fleet deployment and trigger its uninstall, a scenario that could be reached by an internal threat actor with some level of access to the Fleet environment. Successful exploitation would grant the attacker arbitrary privileged code execution on the affected host.