Read the docs
TI-2026-26022 Aliases CVE-2026-33641GHSA-qhj7-v7h7-q4c7

Glances Vulnerable to Command Injection via Dynamic Configuration Values

Priority HIGH 69CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00903 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed glances (nicolargo): 4.5.3Glances (PyPI): 4.5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nicolargoglancesbefore 4.5.34.5.3Patch availableCNA
—Glances (PyPI)before 4.5.34.5.3Patch availableGHSA-qhj7-v7h7-q4c7
  • glances Vendornicolargo Affected before 4.5.3 Fixed in 4.5.3 Patch available CNA
  • Glances (PyPI) Vendor— Affected before 4.5.3 Fixed in 4.5.3 Patch available GHSA-qhj7-v7h7-q4c7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*before 4.5.3Vulnerablenicolargo
  • cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:* Versions before 4.5.3 Vulnerable ·nicolargo

Remediation

  • Fix · CNA glances (nicolargo) Fixed in 4.5.3
  • Fix · GHSA-qhj7-v7h7-q4c7 Glances (PyPI) Fixed in 4.5.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33641
  2. 2026-10-03 Alias added: GHSA-qhj7-v7h7-q4c7

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-25142 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` CVSS 3.1CRITICAL 9.1
  • TI-2026-25106 Glances exposes the REST API without authentication CVSS 4.0HIGH 8.7
  • TI-2026-27083 Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS CVSS 4.0HIGH 7.7
  • TI-2026-25120 Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements CVSS 3.1CRITICAL 9.1
  • TI-2026-25118 Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials CVSS 3.1HIGH 7.5
  • TI-2026-25143 Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers CVSS 3.1HIGH 8.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences