AIKIDO-2026-325249
glances is vulnerable to OS Command Injection
69
Medium Risk
This Affects:
glancesTL;DR
Glances sanitises attacker-influenced stat fields before rendering them into administrator-configured action command templates executed by secure_popen(). The _sanitize_mustache_dict() sanitiser strips shell operators from each value individually but not from the rendered command string. When a template concatenates two adjacent unescaped variables, a trailing single ampersand from one value and a leading one from the next reconstruct a real operator after rendering, re-enabling command chaining, piping and redirection. The fix neutralises lone operator characters so they cannot be recombined across adjacent template variables.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have configured an action command template that concatenates two adjacent unescaped Mustache variables filled from untrusted, user-controlled stat fields such as a process name or command line.
Background info
glances is vulnerable to OS Command Injection in versions 4.5.2 - 4.5.5.
How to fix this
Upgrade the glances library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant