CVE-2026-32608: Glances Command Injection via Process Names in Action Command Templates
Summary
CVE-2026-32608: Glances has a Command Injection via Process Names in Action Command Templates. Affects glances versions < 4.5.2. Fixed in 4.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Glances is a cross-platform monitoring tool that provides real-time insights into system performance, including CPU, memory, and disk usage. It allows administrators to configure actions that trigger shell commands when certain monitoring thresholds are exceeded. This flexibility, while powerful, introduces potential security risks if not properly managed, particularly when user-controllable data is involved.
Vulnerability Detail
The vulnerability arises from the action system in Glances, which allows shell commands to be executed based on monitoring thresholds. These commands can include Mustache template variables populated with runtime data, such as process names or container names. The secure_popen function, responsible for executing these commands, improperly handles command strings containing metacharacters like pipes and redirects. This can lead to command injection, allowing an attacker to execute arbitrary commands with the privileges of the Glances process user, often root. The implications are severe, including privilege escalation and arbitrary file writes.
How To Fix
Latest published version: 4.5.8 as of 23 Oct 2026
pip install --upgrade "glances==4.5.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.5.2
This is the first release that contains the fix.
pip install --upgrade "glances==4.5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize the Mustache-rendered values manually by implementing a function to escape characters treated as operators by secure_popen. Here is a sample code snippet:
# glances/actions.py
def _escape_for_secure_popen(value):
if not isinstance(value, str):
return value
value = value.replace("&&", " ")
value = value.replace("|", " ")
value = value.replace(">", " ")
return value
Conclusion
CVE-2026-32608 poses a significant security risk to Glances users due to its command injection vulnerability. It is crucial to update to the patched version 4.5.2 or later to mitigate this risk. Additionally, implementing the provided workaround can help secure your system until an update can be applied.
See every vulnerability recorded for glances →
FAQ
CVE-2026-32608 is a vulnerability in Glances that allows command injection via process names in action command templates.
An attacker can exploit this vulnerability by controlling process names or container names to inject arbitrary commands when monitoring thresholds are exceeded.
The impacts include arbitrary command execution, privilege escalation, and arbitrary file writes, especially if Glances runs with elevated privileges.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
If you cannot update immediately, implement the provided workaround to sanitize user-controlled inputs in action command templates.
References
Related vulnerabilities
Recent vulnerabilities recorded for glances.
