In breve
- CVE-2026-27806 è una vulnerabilità ALTO (CVSS 7.8) che riguarda github.com/fleetdm/fleet/v4, fleet (fleetdm).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.11%, superiore al 1.3% delle vulnerabilità.
- Correzione: aggiornare a 4.81.1 o successiva.
Description
Summary
The Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges.
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-94: Improper Control of Generation of Code ('Code Injection')
Impact
- Local privilege escalation to root: Any unprivileged local user on a managed endpoint can execute arbitrary commands as root
Credit
This vulnerability was discovered and reported by bugbunny.ai.
NVD description
Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1.
Altre vulnerabilità di github.com/fleetdm/fleet/v4
Vedi tutto →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free