Executive brief
Glances is a system monitoring tool that runs alerts by rendering user-controlled process data into shell commands. A previous fix for command injection was incomplete: it only sanitized top-level string values (like process names) but left nested list values (like process command-line arguments, fully controlled by an attacker) unsanitized. An attacker can exploit this to inject arbitrary OS commands with the privileges of the Glances process, typically root in monitoring deployments.
Technical details
The vulnerability is an incomplete fix of CVE-2026-32608. The sanitizer `_sanitize_mustache_dict` strips shell operators (`&&`, `|`, `>>`, `>`) from top-level string values but skips nested structures (lists and dicts) via an `else: safe[k] = v` pass-through. When the Mustache template renderer (chevron) processes the unsanitized nested list containing a process's `cmdline` arguments—which are fully attacker-controlled via argv—the pipe character `|` is not HTML-escaped by chevron and survives into the rendered command. The downstream `secure_popen` function interprets the surviving `|` as a pipe operator (with `allow_operators=True` by default), enabling command injection. Attack requires: (1) an admin-configured action template that renders a nested stat field like `{{#cmdline}}{{.}}{{/cmdline}}`, and (2) Glances running with privilege to enumerate the attacker's processes (typically root). Patched in v4.5.6.
Affected products
- nicolargo glances >= 4.5.2, < 4.5.6
Timeline
- 2026-08-17: disclosed: GitHub Advisory published
- 2026-08-01: patched: Fixed in v4.5.6