nicolargo glances up to 4.5.4 virsh.py secure_popen os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in nicolargo glances up to 4.5.4. This affects the function secure_popen of the file glances/plugins/vms/engines/virsh.py. The manipulation leads to os command injection. This vulnerability is uniquely identified as CVE-2026-46606. Local access is required to approach this attack. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in nicolargo glances up to 4.5.4. This issue affects the function secure_popen of the file glances/plugins/vms/engines/virsh.py. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-46606 since 05/15/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 4.5.5 eliminates this vulnerability. The upgrade is hosted for download at github.com.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• nicolargo

Name

• glances

Version

• 4.5.0
• 4.5.1
• 4.5.2
• 4.5.3
• 4.5.4

Website

• Product: https://github.com/nicolargo/glances/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion