Arbitrary Command Execution in Glances by Nicolargo

CVE-2026-33641

What is CVE-2026-33641?

Glances is an open-source, cross-platform monitoring tool that allows for dynamic configuration values. Prior to version 4.5.3, Glances processes substrings enclosed in backticks as system commands during configuration parsing without proper validation. This behavior poses a significant security risk, enabling attackers to execute arbitrary commands if they can manipulate configuration files. Such execution occurs with the privileges of the Glances process, which could lead to privilege escalation, particularly when Glances operates with elevated privileges as a system service. The issue has been addressed in version 4.5.3.

References