AIKIDO-2026-325249

TL;DR

Glances sanitises attacker-influenced stat fields before rendering them into administrator-configured action command templates executed by secure_popen(). The _sanitize_mustache_dict() sanitiser strips shell operators from each value individually but not from the rendered command string. When a template concatenates two adjacent unescaped variables, a trailing single ampersand from one value and a leading one from the next reconstruct a real operator after rendering, re-enabling command chaining, piping and redirection. The fix neutralises lone operator characters so they cannot be recombined across adjacent template variables.