TI-2021-06110 Aliases CVE-2021-23418 GHSA-r2mj-8wgq-73m6

XML external entity (XXE) injection in Glances

MEDIUM 45CWE-611Published 2021-07-29 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

Why it matters now

EPSS 0.01653 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Glances: 3.2.1Glances (PyPI): 3.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Glances	before 3.2.1	3.2.1	Patch available	CNA
—	Glances (PyPI)	before 3.2.1	3.2.1	Patch available	GHSA-r2mj-8wgq-73m6

Glances Vendor— Affected before 3.2.1 Fixed in 3.2.1 Patch available CNA
Glances (PyPI) Vendor— Affected before 3.2.1 Fixed in 3.2.1 Patch available GHSA-r2mj-8wgq-73m6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:glances_project:glances::::::::	before 3.2.1	Vulnerable	Glances Project

cpe:2.3:a:glances_project:glances:*:*:*:*:*:*:*:* Versions before 3.2.1 Vulnerable ·Glances Project

Remediation

Fix · CNA Glances Fixed in 3.2.1
Fix · GHSA-r2mj-8wgq-73m6 Glances (PyPI) Fixed in 3.2.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2021-23418
2026-10-03 Alias added: GHSA-r2mj-8wgq-73m6

References

Exploit 1

https://github.com/nicolargo/glances/issues/1025

Patch 3

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences