Fleet

An improper sanitization vulnerability in Fleet's macOS app install/uninstall script generator allowed arbitrary command execution as root via malicious Homebrew cask metadata.

A SQL injection vulnerability in the Fleet Premium Okta conditional access integration allows an enrolled host to execute arbitrary database queries, leading to privilege escalation and potential remote code execution.

Fleet is affected by multiple security vulnerabilities that allow unauthenticated or authenticated attackers to perform SQL injection, arbitrary code execution, and unauthorized data manipulation.

The Orbit agent is vulnerable to local privilege escalation due to Tcl command injection, where a crafted password containing '}' can inject arbitrary Tcl commands and allow an unprivileged local user to execute commands as root.