EUVD-2026-60305
GHSA-59fj-m2j6-hcxh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and config-file write privilege (PR:H, AV:L) are required; impact is bounded to the Glances process with no scope change to other components (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 4 pypi packages depend on glances (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.5.6.
DescriptionCVE.org
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.
AnalysisAI
Glances versions through 4.5.5 contain an incomplete fix for CVE-2026-53925: the --disable-config-exec flag correctly suppresses shell operator interpretation in AMP module commands but fails to do so for on-alert action commands in glances/actions.py, where secure_popen() is called without allow_operators=False. An attacker with write access to glances.conf can place shell metacharacters (>, &&, |) in alert action directives, which execute at the Glances process privilege when an alert threshold is crossed - despite the operator supposedly operating in hardened mode. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have write access to the Glances configuration file (`glances.conf`) on the local system - this is the primary trust boundary identified in the advisory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:H/UI:N) with score 7.1 accurately represents the constrained threat model: local access is required, and the attacker must hold write privileges over the Glances configuration file (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with write access to `glances.conf` modifies a CPU threshold alert action to include a shell redirect, for example `user_critical_action=id > /tmp/pwned`, then induces CPU load to trigger the CRITICAL alert threshold. When `GlancesActions.run()` fires, `secure_popen()` receives `allow_operators=True` (the unpatched default) and interprets the `>` operator, writing the output of `id` to `/tmp/pwned` at the privilege of the Glances process - despite `--disable-config-exec` being active. … |
| Remediation | Upgrade Glances to version 4.5.6 via `pip install --upgrade 'glances==4.5.6'`; the fix (commit 5c07c0d96423e9d5b9de71dd92e3717c66f504bd) adds an `allow_operators()` method to `GlancesActions` that propagates the `--disable-config-exec` flag into all `secure_popen()` calls on the alert action path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running Glances versions through 4.5.5, document their operational scope and privilege levels, and audit glances.conf file permissions to determine exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse unt
Command injection in Glances prior to 4.5.6 allows a local unprivileged user to execute arbitrary shell commands when ad
Glances is an open-source system cross-platform monitoring tool. versions up to 4.5.1 is affected by information exposur
Command injection in Glances system monitoring (versions 4.5.2 through 4.5.5) allows a local attacker with process-execu
SQL injection in Glances TimescaleDB export module allows local attackers to execute arbitrary SQL commands against the
Glances REST API prior to 4.5.6 exposes authenticated system monitoring data to untrusted cross-origin websites due to a
Credential disclosure in Glances prior to 4.5.6 allows unauthenticated remote attackers to retrieve plaintext usernames
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today