Executive brief
Glances is a system monitoring tool that can be configured with alert actions that execute commands when performance thresholds are crossed. The `--disable-config-exec` flag is supposed to prevent shell operators like file redirection (>) and command chaining (&&) from being interpreted in these commands. However, version 4.5.5 fails to apply this protection to alert action commands while correctly applying it to other command types. An attacker who can edit the configuration file can write arbitrary files or chain commands at the privilege level of the glances process when an alert triggers.
Technical details
This is an incomplete fix of a prior security hardening (GHSA-3vwc-qwhc-3mj7). The vulnerability exists in `glances/actions.py` line 111, where `secure_popen(cmd_full)` is called without the `allow_operators` parameter that controls interpretation of shell metacharacters. In contrast, AMP modules in `glances/amps/default/__init__.py:69` and `glances/amps/systemv/__init__.py:60` correctly pass `allow_operators=self.allow_operators()` to respect the `--disable-config-exec` setting. The root cause is that the hardening was inconsistently applied across code paths that both read commands from the configuration file. An attacker with write access to the glances configuration file can inject shell operators (>, &&, |) into alert action commands, and these will be interpreted by the shell when the corresponding alert condition is met. The fix requires passing the `allow_operators` parameter consistently from `GlancesActions.run()` to `secure_popen()` in the alert action path. A patch is available in version 4.5.6.
Affected products
- nicolargo Glances <= 4.5.5
Timeline
- 2026-08-17: disclosed
- 2026-08-01: patched: Version 4.5.6 released with fix