Arbitrary Code Execution in Glances Monitoring Tool by Nicolargo

CVE-2026-46607

What is CVE-2026-46607?

The Glances monitoring tool, prior to version 4.5.5, is susceptible to arbitrary code execution due to improper handling of a version-check cache file. The glances/outdated.py script utilizes pickle.load() to read this cache file, which is stored at a predictable and world-accessible location. Without integrity checks or verification measures, an attacker with write access can exploit this to inject malicious code, potentially compromising the system upon the next execution of Glances with version checking enabled. This critical flaw has been addressed and resolved in version 4.5.5.

References