Glances Configuration and SQL Injection Flaws

Glances is an open-source system cross-platform monitoring tool. versions up to 4.5.1 is affected by information exposure.

SQL injection in Glances TimescaleDB export module allows local attackers to execute arbitrary SQL commands against the monitoring database. The vulnerability stems from unsafe string concatenation when constructing queries with system monitoring data (process names, mount points, network interfaces, container names). Proof-of-concept exploit code exists (CVSS E:P). EPSS score of 0.02% (4th percentile) indicates very low observed exploitation activity. Vendor-released patch available in version 4.5.1.