CVE-2026-32611

published 2026-03-18

CVE-2026-32611: Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by…

Priority P3 53 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	glances	< glances 4.5.2+dfsg-1 (forky)	glances 4.5.2+dfsg-1 (forky)
glances_project	glances	>= 0 < 4.5.2+dfsg-1	4.5.2+dfsg-1
glances_project	glances	>= 0 < 4.5.2	4.5.2
nicolargo	glances	< 4.5.2	4.5.2

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

osv 9.1 CRITICAL

vendor_debian 7.0 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89