8.9 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Attack Requirement (AT): Present (P)
- Privileges Required (PR): High (H)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): High (H)
- Subsequent System Impact Integrity (SI): High (H)
- Subsequent System Impact Availability (SA): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Attack Requirement (MAT): Present (P)
- Modified Privileges Required (MPR): High (H)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): High (H)
- Modified Subsequent System Impact Integrity (MSI): High (H)
- Modified Subsequent System Impact Availability (MSA): High (H)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
17 packages
- fleetctl
- fleet-orbit
- fleet-desktop
- fleeting-plugin-aws
- azure-cli-extensions.fleet
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- python313Packages.types-aiobotocore-iotfleethub
- python314Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleetwise
- python314Packages.types-aiobotocore-iotfleetwise
- @LeSuisse accepted
- @LeSuisse published on GitHub
Fleet Homebrew Cask OS Command Injection via Metadata
Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters (for example $(...) command substitution) could be carried into scripts that execute as root on managed macOS hosts. An attacker who could land crafted metadata in an upstream Homebrew cask — without needing any Fleet credentials — could achieve arbitrary command execution as root on managed macOS hosts that install or uninstall the affected Fleet-maintained app; exploitation required the crafted metadata to pass both upstream Homebrew cask review and Fleet's review of the automated ingestion pull request. The fix (fleetdm/fleet#51324) landed in Fleet's ingestion pipeline on 2026-08-19 so that all manifests generated on or after that date escape cask metadata at every interpolation site; because manifests are generated centrally and distributed as pre-built content, remediation applied to all deployments with no customer action, and the code fix is included in Fleet v4.92.0.
References
-
GitHub Security Advisory (GHSA-fv3p-h7wv-2jgm) vendor-advisory
-
VulnCheck Advisory: Fleet Homebrew Cask OS Command Injection via Metadata third-party-advisory
Affected products
Matching in nixpkgs
Ignored packages (17)
pkgs.fleetctl
CLI tool for managing Fleet
pkgs.fleet-orbit
Fleet's lightweight osquery manager
-
nixos-unstable -
- nixos-unstable-small 1.55.0
pkgs.fleet-desktop
Fleet's desktop tray application
-
nixos-unstable -
- nixos-unstable-small 1.55.0
pkgs.fleeting-plugin-aws
GitLab fleeting plugin for AWS
pkgs.azure-cli-extensions.fleet
Microsoft Azure Command-Line Tools Fleet Extension
pkgs.python313Packages.tesla-fleet-api
Python library for Tesla Fleet API and Teslemetry
pkgs.python314Packages.tesla-fleet-api
Python library for Tesla Fleet API and Teslemetry
pkgs.haskellPackages.amazonka-iotfleethub
Amazon IoT Fleet Hub SDK
-
nixos-unstable -
- nixos-unstable-small 2.0-unstable-2025-04-16
-
nixos-26.05 -
- nixos-26.05-small 2.0-unstable-2025-04-16
pkgs.haskellPackages.amazonka-iotfleetwise
Amazon IoT FleetWise SDK
-
nixos-unstable -
- nixos-unstable-small 2.0-unstable-2025-04-16
-
nixos-26.05 -
- nixos-26.05-small 2.0-unstable-2025-04-16
pkgs.python313Packages.mypy-boto3-iotfleethub
Type annotations for boto3 iotfleethub
pkgs.python314Packages.mypy-boto3-iotfleethub
Type annotations for boto3 iotfleethub
pkgs.python313Packages.mypy-boto3-iotfleetwise
Type annotations for boto3 iotfleetwise
pkgs.python314Packages.mypy-boto3-iotfleetwise
Type annotations for boto3 iotfleetwise
pkgs.python313Packages.types-aiobotocore-iotfleethub
Type annotations for aiobotocore iotfleethub
pkgs.python314Packages.types-aiobotocore-iotfleethub
Type annotations for aiobotocore iotfleethub
-
nixos-unstable -
- nixos-unstable-small 2.24.2
pkgs.python313Packages.types-aiobotocore-iotfleetwise
Type annotations for aiobotocore iotfleetwise
pkgs.python314Packages.types-aiobotocore-iotfleetwise
Type annotations for aiobotocore iotfleetwise
-
nixos-unstable -
- nixos-unstable-small 3.9.1
Package maintainers
-
@bddvlpr Luna Simons <luna@bddvlpr.com>
-
@asauzeau Antoine Sauzeau <antoine.sauzeau3@gmail.com>
-
@LeSuisse Thomas Gerbet <thomas@gerbet.me>