SQL Injection Vulnerability in Glances DuckDB Export Module

CVE-2026-32611

What is CVE-2026-32611?

The Glances monitoring tool has a vulnerability in its DuckDB export module where SQL operations interpolate table and column names directly into statements, risking SQL injection. This issue arises from the lack of parameterization in DDL construction. Although INSERT values use parameterized queries, the direct embedding of identifiers from monitoring statistics poses a security threat. The issue has been partially addressed in version 4.5.3, which aims to enhance data protection through improved query handling.

References