GHSA-rphv-h674-5hp2: Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit

The Orbit agent (software that manages computer endpoints) has a vulnerability in how it handles disk encryption key rotation. When a user enters their password through a dialog box, the software directly inserts it into a Tcl script (a programming language for automation) without properly cleaning it first. An attacker can craft a password containing special characters like `}` to break out of the script and inject their own commands, which then run with root privileges (the highest level of system access), allowing any unprivileged local user to take complete control of the computer.