AIKIDO-2026-405872
glances is vulnerable to OS Command Injection
78
CVE Score
High
OS Command Injection
TL;DR
Glances runs on-alert action commands defined in the configuration file through secure_popen(), which interprets the shell operators &&, | and >. The --disable-config-exec protection that stops operator interpretation for AMP command values is not applied to the on-alert action command path. With --disable-config-exec enabled, a configured alert action still has these operators interpreted, allowing file redirection, command chaining and piping at the privilege of the Glances process when the alert fires. The fix propagates the disable flag into the action command path so operators are no longer interpreted.
How do I fix this?
Upgrade the glances library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run Glances with --disable-config-exec and rely on it to neutralise shell operators in configuration-defined on-alert action commands.
Package
Versions
4.5.5 - 4.5.5
Fixed in 4.5.6Background info
glances is vulnerable to OS Command Injection in versions 4.5.5 - 4.5.5.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.