CVE-2026-62982 in Glances
Summary
by MITRE • 08/17/2026
Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by secure_popen() through administrator-configured action templates. This issue is fixed in 4.5.6.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
Glances is a widely utilized open-source system monitoring tool that provides cross-platform capabilities for tracking CPU, memory, disk, network, and process metrics. The vulnerability identified within versions ranging from 4.5.2 to 4.5.6 resides in the action processing logic, specifically affecting the _sanitize_mustache_dict() function located in the glances/actions.py module. This component is responsible for sanitizing data before it is rendered into templates or executed as system commands. The core technical flaw involves an incomplete input validation mechanism where nested list and dictionary strings are not properly escaped during the sanitization process. When user-controlled data, such as process command line arguments which can contain arbitrary characters including pipe symbols, passes through this function, the nested structures bypass the intended security checks. This oversight allows maliciously crafted inputs to survive the chevron.render() step without being neutralized of dangerous shell metacharacters.
The operational impact of this vulnerability is significant because it leads to Command Injection when administrator-configured action templates are utilized. Once the unsanitized data containing pipe characters reaches the secure_popen() function, these characters are interpreted by the underlying operating system's command interpreter rather than being treated as literal string content. This allows an attacker who can influence process names or command line arguments displayed in Glances to inject arbitrary shell commands that execute with the privileges of the user running the Glances service. If Glances is configured to run actions triggered by specific conditions, such as high CPU usage alerts, and these triggers rely on data derived from monitored processes, an attacker could potentially achieve remote code execution or privilege escalation depending on the context in which Glanes operates. This aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection.
The attack vector typically involves manipulating process information that is visible to the monitoring tool, such as by executing a program with a specially crafted command line argument containing shell metacharacters like pipes or semicolons. When Glances processes this data for display or action triggering, the flawed sanitization logic fails to escape these characters within nested structures. The vulnerability highlights a critical gap in handling complex data types during template rendering and subsequent execution phases. It underscores the importance of rigorous input validation not just at entry points but also when processing dynamic content that may be embedded within lists or dictionaries before being passed to system-level functions like secure_popen().
Mitigation strategies primarily involve upgrading Glances to version 4.5.6 or later, where this sanitization logic has been corrected to properly handle nested data structures and escape special characters effectively. For environments where immediate patching is not feasible, administrators should restrict the execution of action templates to only those that do not rely on dynamic user-controlled input from monitored processes. Additionally, running Glances with minimal privileges can help limit the potential impact of a successful exploitation attempt. Security monitoring solutions must ensure that all data passed through template engines and command executors undergoes strict canonicalization and escaping procedures consistent with industry standards for preventing injection attacks as defined in CWE-78 and mapped to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse.