CVE-2026-101045

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.92.0

Description Install and uninstall scripts for macOS apps are generated using Homebrew cask metadata. In manifests created before 2026-08-19, the script generator failed to escape metadata at all interpolation sites. This allows shell metacharacters, such as $(...) command substitution, to be included in scripts that execute with root privileges on managed macOS hosts. An attacker who successfully introduces crafted metadata into an upstream Homebrew cask could achieve arbitrary command execution as root on hosts that install or uninstall the affected application. This requires the malicious metadata to pass both the Homebrew cask review and the Fleet automated ingestion review.

Recommendations Update to Fleet version 4.92.0.