CVE-2026-33641
published 2026-04-02CVE-2026-33641: Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings…
PriorityP353high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
0.87%
54.1th percentile
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glances | < glances 4.5.3.2+dfsg-1 (forky) | glances 4.5.3.2+dfsg-1 (forky) |
| glances_project | glances | >= 0 < 4.5.3.2+dfsg-1 | 4.5.3.2+dfsg-1 |
| glances_project | glances | 0 – 4.5.2 | — |
| glances_project | glances | >= 4.0.8 < 4.5.5 | 4.5.5 |
| nicolargo | glances | < 4.5.3 | 4.5.3 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa7.8HIGH
osv7.8HIGH
vendor_debian7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
ghsa·2026-06-23·CVSS 7.8
CVE-2026-53925 [HIGH] CWE-22 Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
### Summary
The `secure_popen()` function in `glances/secure.py` interprets `>` (file redirection), `|` (pipe), and `&&` (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command.
When Application Monitoring Process (AMP) modules load their `command` or `service_cmd` configuration values from `glances.conf`, those values are passed directly to `secure_popen()` with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via `>`), chain arbitrary commands (via `&&`)
OSV
CVE-2026-33641: (Glances is an open-source system cross-platform monitoring tool
osv·2026-04-03·CVSS 7.8
CVE-2026-33641 [HIGH] CVE-2026-33641: (Glances is an open-source system cross-platform monitoring tool
(Glances is an open-source system cross-platform monitoring tool. Prior ...)
OSV
CVE-2026-33641: Glances is an open-source system cross-platform monitoring tool
osv·2026-04-02·CVSS 7.8
CVE-2026-33641 [HIGH] CVE-2026-33641: Glances is an open-source system cross-platform monitoring tool
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.
GHSA
Glances Vulnerable to Command Injection via Dynamic Configuration Values
ghsa·2026-03-30
CVE-2026-33641 [HIGH] CWE-78 Glances Vulnerable to Command Injection via Dynamic Configuration Values
Glances Vulnerable to Command Injection via Dynamic Configuration Values
## Summary
Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands.
If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation.
## Details
1. Glances loads configuration files from user, system, or custom paths during initialization.
2. When retrieving
OSV
Glances Vulnerable to Command Injection via Dynamic Configuration Values
osv·2026-03-30
CVE-2026-33641 [HIGH] Glances Vulnerable to Command Injection via Dynamic Configuration Values
Glances Vulnerable to Command Injection via Dynamic Configuration Values
## Summary
Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands.
If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation.
## Details
1. Glances loads configuration files from user, system, or custom paths during initialization.
2. When retrieving
Debian
CVE-2026-33641: glances - Glances is an open-source system cross-platform monitoring tool. Prior to versio...
vendor_debian·2026·CVSS 7.8
CVE-2026-33641 [HIGH] CVE-2026-33641: glances - Glances is an open-source system cross-platform monitoring tool. Prior to versio...
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.
Scope: local
bookworm: open
forky: resolved (fixed in 4.5.3.2+dfsg-1)
sid: re
No detection rules found.
2026-04-02
Published