AIKIDO-2026-392230

TL;DR

Glances renders monitoring stat fields into administrator-configured action command templates and executes the result through secure_popen(). The _sanitize_mustache_dict() sanitiser only strips shell operators from top-level string values and passes nested list or dict values through unchanged. A process cmdline, which is attacker-controlled through argv and exposed as a list, can carry a | that survives Mustache rendering and is interpreted as a pipe, re-enabling OS command injection in the Glances process context. The fix sanitises stat values recursively so operators inside nested values are also neutralised.