Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M

CVE-2026-34387Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts

Medium 5.7

In plain English

A medium-severity OS command injection in fleet from fleetdm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 4.0)5.7Medium

Exploit odds (30 days)1.3%top 28.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
fleetdm	fleet	< 4.81.1

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

https://github.com/fleetdm/fleet/security/advisories/GHSA-7rhw-5mpv-gp4h x_refsource_CONFIRM