Glances
CVE-2026-30930
HIGH
GHSA-x46r-mf5g-xpr6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionGitHub Advisory
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1.
AnalysisAI
SQL injection in Glances TimescaleDB export module allows local attackers to execute arbitrary SQL commands against the monitoring database. The vulnerability stems from unsafe string concatenation when constructing queries with system monitoring data (process names, mount points, network interfaces, container names). Proof-of-concept exploit code exists (CVSS E:P). EPSS score of 0.02% (4th percentile) indicates very low observed exploitation activity. Vendor-released patch available in version 4.5.1.
Technical ContextAI
Glances is a cross-platform system monitoring tool written in Python that exports metrics to various backends including TimescaleDB (PostgreSQL time-series extension). The vulnerability (CWE-89: SQL Injection) resides in the TimescaleDB export module's normalize() method, which wraps string values in single quotes but fails to escape embedded single quotes within the data. When system monitoring data containing malicious payloads (e.g., a process named "evil' OR '1'='1") is concatenated into SQL INSERT statements, the attacker-controlled strings break out of their intended context. Because Glances collects data from local system sources (process lists, filesystem mounts, network interfaces, Docker containers), an attacker with the ability to create processes or containers with crafted names can inject SQL. The affected CPE (cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*) covers all Glances versions prior to 4.5.1.
RemediationAI
Upgrade to Glances version 4.5.1 or later, which implements proper SQL parameterization in the TimescaleDB export module per commit 39161f0d6fd723d83f534b48f24cdca722573336 (https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336). The fix replaces string concatenation with prepared statements that safely handle special characters. For systems unable to upgrade immediately, disable the TimescaleDB export module in the Glances configuration file (set timescaledb export to false or remove the timescaledb section). Trade-off: disabling TimescaleDB export eliminates long-term metric storage and historical analysis capabilities. Alternative mitigation: restrict local user ability to create arbitrarily-named processes and containers through OS-level controls (SELinux policies, AppArmor profiles, container runtime restrictions), though this is operationally complex and may interfere with legitimate workloads. Verify the patch by inspecting the normalize() method for parameterized query usage rather than string concatenation.
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse unt
Command injection in Glances prior to 4.5.6 allows a local unprivileged user to execute arbitrary shell commands when ad
Glances is an open-source system cross-platform monitoring tool. versions up to 4.5.1 is affected by information exposur
Command injection in Glances system monitoring (versions 4.5.2 through 4.5.5) allows a local attacker with process-execu
Glances versions through 4.5.5 contain an incomplete fix for CVE-2026-53925: the `--disable-config-exec` flag correctly
Glances REST API prior to 4.5.6 exposes authenticated system monitoring data to untrusted cross-origin websites due to a
Credential disclosure in Glances prior to 4.5.6 allows unauthenticated remote attackers to retrieve plaintext usernames
Same weakness CWE-89 – SQL Injection
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today