CVE-2026-68518: Glances command injection via cross-field shell-operator reconstruction

CVE-2026-68518 · Severity: high · CVSS 4 · Published 2026-08-17

Glances is a system monitoring tool that executes administrator-configured shell commands when monitoring thresholds are crossed. The tool processes dynamic data like process names and container names supplied by unprivileged users. An attacker can craft malicious process or container names that, when combined with adjacent template variables in an unescaped Mustache template, reconstruct forbidden shell operators (like `&&`) across variable boundaries, leading to arbitrary command execution with the privileges of the Glances process (often root).

Technologies: glances (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-68518 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68518 being exploited in the wild.
How severe is CVE-2026-68518?
High severity, with a CVSS score of 4, published 17 August 2026.
Which products and versions are affected?
glances (PyPI) <= 4.5.5, ECOSYSTEM:introduced=0,fixed=4.5.6.
Is there a fix for CVE-2026-68518?
Yes. glances (PyPI): upgrade to 4.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68518 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-68518?
Check whether you run glances (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • glances (PyPI): upgrade to 4.5.6 or later
    pip install "glances>=4.5.6"

Technical details

The vulnerability is a command injection flaw in the `_sanitize_mustache_dict()` function in `glances/actions.py`. The function strips multi-character shell operators (`&&`, `|`, `>>`, `>`) from individual template values before Mustache rendering. However, it does not remove single `&`, `|`, or `>` characters. When two adjacent unescaped Mustache variables (e.g., `{{{name}}}{{{cmdline}}}`) are rendered, attacker-controlled values can be positioned to reconstruct operators across variable boundaries: a trailing `&` from the first variable plus a leading `&` from the second variable reconstitute a literal `&&` in the final command string. The `secure_popen()` function then interprets this reconstructed operator and executes the injected command via `subprocess.Popen(shell=False)`. The attack requires a local unprivileged user to control two adjacent stat fields (e.g., process/container name and command line) and an administrator to have configured an action template with adjacent unescaped variables. A patched version (4.5.6) is available.

Affected products

  • nicolargo Glances <= 4.5.5

Identifiers

  • CVE-2026-68518
  • GHSA-qcpp-8x79-hhp3
  • PYSEC-2026-3668

Timeline

  • 2026-08-17: disclosed
  • 2026-08-01: patched: Version 4.5.6 patches the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.