Fleet is open source device management software. In versions prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow collects a local user's password and interpolates it directly into a Tcl/expect script executed via exec.Command. The password is inserted inside Tcl brace-quoted send {%s}, but if the password contains the '}' character, it prematurely terminates the Tcl literal and allows injection of arbitrary Tcl commands. Because Orbit runs as root, this vulnerability enables local privilege escalation from an unprivileged user to root. The issue is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability is fixed in Fleet version 4.81.1.

A local unprivileged user can exploit this vulnerability to execute arbitrary Tcl commands with root privileges due to improper input sanitization of the password in the Orbit agent. This leads to full system compromise via local privilege escalation. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in Fleet version 4.81.1. Users should upgrade to version 4.81.1 or later to remediate this issue. Patch status is not explicitly stated beyond this fix version, but upgrading to 4.81.1 is the recommended remediation. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes.