Command Injection Vulnerability in Glances Monitoring Tool by Nicolas Grégoire

CVE-2026-32608

What is CVE-2026-32608?

A command injection vulnerability has been discovered in the Glances monitoring tool, allowing an attacker to exploit the system by injecting arbitrary commands. This occurs when the tool processes Mustache template variables from monitored data, such as process names or container names. If these variables include particular metacharacters, it can lead to unexpected command execution. The issue is present in versions prior to 4.5.2, where the secure_popen() function does not correctly handle command input, potentially allowing unauthorized command control.

References