A local attacker can place malicious commands in a PowerShell profile before a Netdata Windows Agent MSI repair; when the repair runs powershell.exe as SYSTEM without the -NoProfile flag, those commands execute with SYSTEM privileges, allowing the attacker to gain full control over the host.

The Windows Agent installer of Netdata, for versions 2.0.0 through 2.10.3 (any sub‑version prior to 2.10.4), is affected by this flaw.

The vulnerability has a CVSS score of 7.8 and is not listed in the CISA KEV catalog; the EPSS score is not available. The attack requires a local user with the ability to initiate the MSI repair, after which the injected PowerShell profile runs with SYSTEM rights, creating a straightforward privilege escalation path.