Executive brief
Glances, a popular cross-platform system monitoring tool, contains a vulnerability that allows users with access to the configuration file to execute unauthorized commands. By modifying the configuration to include specific symbols like pipes or redirects, an attacker can force the application to write malicious files or run arbitrary code with the privileges of the Glances process. This could lead to a full system takeover or unauthorized data access, and notably bypasses previous security restrictions intended to prevent such actions.
Technical details
A vulnerability exists in the `secure_popen()` function within `glances/secure.py` due to the manual interpretation of shell operators including `>`, `|`, and `&&`. When Application Monitoring Process (AMP) modules load `command` or `service_cmd` values from `glances.conf`, these strings are passed to `secure_popen()` without sanitization. An attacker with the ability to modify the configuration file can achieve arbitrary file writes (via redirection) or command chaining. This flaw is distinct from CVE-2026-33641; the `--disable-config-exec` flag does not mitigate this issue as it only targets backtick execution in `config.get_value()`, whereas this vulnerability resides in the subsequent processing of the command string. The issue is resolved in version 4.5.5.
Affected products
- nicolargo Glances >= 4.0.8, < 4.5.5
Timeline
- 2026-06-13: advisory: GitHub advisory published by maintainer
- 2026-06-25: disclosed: NVD publication date
- 2026-06-25: patched: Fixed in version 4.5.5