CVE-2026-32608 — OS Command Injection in Glances

Vendor	Product	Version range	Fixed in
debian	glances	< glances 4.5.2+dfsg-1 (forky)	glances 4.5.2+dfsg-1 (forky)
glances_project	glances	>= 0 < 4.5.2+dfsg-1	4.5.2+dfsg-1
glances_project	glances	>= 0 < 4.5.2	4.5.2
nicolargo	glances	< 4.5.2	4.5.2

Debian

CVE-2026-32608: glances - Glances is an open-source system cross-platform monitoring tool. The Glances act...

vendor_debian·2026·CVSS 7.0

CVE-2026-32608 [HIGH] CVE-2026-32608: glances - Glances is an open-source system cross-platform monitoring tool. The Glances act... Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., `{{name}}`, `{{key}}`) that are populated with runtime monitoring data. The `secure_popen()` function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to `subprocess.Popen(shell=False)`. Prior to 4.5.2, when a Mustache-rendered value (such as a process name, filesystem mount point, or container name) contains pipe, redirect, or chain metacharacters, the rendered command is split in unintended ways, allowing an attacker who controls a pro

OSV

CVE-2026-32608: Glances is an open-source system cross-platform monitoring tool

osv·2026-03-18·CVSS 7.0

CVE-2026-32608 [HIGH] CVE-2026-32608: Glances is an open-source system cross-platform monitoring tool Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., `{{name}}`, `{{key}}`) that are populated with runtime monitoring data. The `secure_popen()` function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to `subprocess.Popen(shell=False)`. Prior to 4.5.2, when a Mustache-rendered value (such as a process name, filesystem mount point, or container name) contains pipe, redirect, or chain metacharacters, the rendered command is split in unintended ways, allowing an attacker who controls a pro

OSV

Glances has a Command Injection via Process Names in Action Command Templates

osv·2026-03-16

CVE-2026-32608 [HIGH] Glances has a Command Injection via Process Names in Action Command Templates Glances has a Command Injection via Process Names in Action Command Templates ## Summary The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., `{{name}}`, `{{key}}`) that are populated with runtime monitoring data. The `secure_popen()` function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to `subprocess.Popen(shell=False)`. When a Mustache-rendered value (such as a process name, filesystem mount point, or container name) contains pipe, redirect, or chain metacharacters, the rendered command is split in unintended ways, allowing an attacker who cont

GHSA

Glances has a Command Injection via Process Names in Action Command Templates

ghsa·2026-03-16

CVE-2026-32608 [HIGH] CWE-78 Glances has a Command Injection via Process Names in Action Command Templates Glances has a Command Injection via Process Names in Action Command Templates ## Summary The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., `{{name}}`, `{{key}}`) that are populated with runtime monitoring data. The `secure_popen()` function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to `subprocess.Popen(shell=False)`. When a Mustache-rendered value (such as a process name, filesystem mount point, or container name) contains pipe, redirect, or chain metacharacters, the rendered command is split in unintended ways, allowing an attacker who cont

CVE-2026-32608: Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when…

Affected

CVSS provenance