CVE-2026-62982: Glances incomplete command injection sanitizer fix in nested stat values

CVE-2026-62982 · Severity: high · CVSS 8.8 · Published 2026-08-17

Glances is a system monitoring tool that runs alerts by rendering user-controlled process data into shell commands. A previous fix for command injection was incomplete: it only sanitized top-level string values (like process names) but left nested list values (like process command-line arguments, fully controlled by an attacker) unsanitized. An attacker can exploit this to inject arbitrary OS commands with the privileges of the Glances process, typically root in monitoring deployments.

Technologies: glances (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-62982 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62982 being exploited in the wild.
How severe is CVE-2026-62982?
High severity, with a CVSS score of 8.8, published 17 August 2026.
Which products and versions are affected?
glances (PyPI) >= 4.5.2, < 4.5.6, ECOSYSTEM:introduced=4.5.2,fixed=4.5.6.
Is there a fix for CVE-2026-62982?
Yes. glances (PyPI): upgrade to 4.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62982 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-62982?
Check whether you run glances (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • glances (PyPI): upgrade to 4.5.6 or later
    pip install "glances>=4.5.6"

Technical details

The vulnerability is an incomplete fix of CVE-2026-32608. The sanitizer `_sanitize_mustache_dict` strips shell operators (`&&`, `|`, `>>`, `>`) from top-level string values but skips nested structures (lists and dicts) via an `else: safe[k] = v` pass-through. When the Mustache template renderer (chevron) processes the unsanitized nested list containing a process's `cmdline` arguments—which are fully attacker-controlled via argv—the pipe character `|` is not HTML-escaped by chevron and survives into the rendered command. The downstream `secure_popen` function interprets the surviving `|` as a pipe operator (with `allow_operators=True` by default), enabling command injection. Attack requires: (1) an admin-configured action template that renders a nested stat field like `{{#cmdline}}{{.}}{{/cmdline}}`, and (2) Glances running with privilege to enumerate the attacker's processes (typically root). Patched in v4.5.6.

Affected products

  • nicolargo glances >= 4.5.2, < 4.5.6

Identifiers

  • CVE-2026-62982
  • GHSA-73wf-9vmv-5pv9
  • PYSEC-2026-3666

Timeline

  • 2026-08-17: disclosed: GitHub Advisory published
  • 2026-08-01: patched: Fixed in v4.5.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.