Executive Summary

CVE-2026-32608 is a command injection vulnerability in the Glances monitoring tool. Glances allows administrators to configure shell commands that run when certain monitoring thresholds are exceeded. These commands use Mustache templates populated with runtime data such as process names or container names. The vulnerability arises because the function executing these commands splits the command string on shell metacharacters like pipes (|), redirects (>), and command chaining (&&) without properly sanitizing the input. If an attacker controls a process or container name containing these metacharacters, they can inject arbitrary commands that get executed on the system.

The root cause is that the command execution function splits the command string incorrectly when these special characters appear in the rendered template values, allowing injection of additional commands. This can lead to arbitrary command execution with the privileges of the Glances process.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker who can create or control process or container names on the monitored system to execute arbitrary commands with the privileges of the Glances process, which is often root.

• Arbitrary command execution on the system.
• Potential privilege escalation if Glances runs with elevated privileges.
• Arbitrary file writes via output redirection in injected commands.

The attack requires that an administrator has configured action commands referencing user-controllable fields and that the attacker can create processes or containers on the system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'Detection of this vulnerability involves monitoring for suspicious or unexpected command executions triggered by Glances actions that include user-controllable fields such as process names or container names containing shell metacharacters.'}, {'type': 'paragraph', 'content': 'Since the vulnerability arises when Glances executes configured shell commands with Mustache-rendered values containing shell operators (e.g., |, &&, >), you can look for unusual command executions or logs indicating command injection attempts.'}, {'type': 'paragraph', 'content': 'Specific commands to detect exploitation attempts might include searching for processes or containers with suspicious names containing shell metacharacters, for example:'}, {'type': 'list_item', 'content': "List processes with suspicious names: ps aux | grep -E '[|&>]'"}, {'type': 'list_item', 'content': "List Docker containers with suspicious names: docker ps --format '{{.Names}}' | grep -E '[|&>]'"}, {'type': 'paragraph', 'content': 'Additionally, monitoring Glances action logs or system logs for unexpected command executions or errors related to command splitting may help detect exploitation.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade Glances to version 4.5.2 or later, where the issue is fixed by sanitizing Mustache-rendered values to remove or replace shell metacharacters.

If upgrading is not immediately possible, apply the following mitigations:

• Avoid using shell operators such as pipes (|), redirections (> or >>), and command chaining (&&) directly in Glances action command lines.
• Instead, move complex shell commands into separate shell scripts and invoke those scripts from Glances actions.
• Sanitize or validate any user-controllable fields (process names, container names, mount points) used in action commands to ensure they do not contain shell metacharacters.

These steps prevent command injection by ensuring that malicious input cannot break the command string into unintended segments.

Useful 0 Not Useful 0