CVE-2026-62982
Received Received - Intake

Glances Cross-Site Command Injection via Unsanitized Pipe Characters

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by secure_popen() through administrator-configured action templates. This issue is fixed in 4.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-62982
EUVD
EUVD-2026-60303

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
nicolargo glances From 4.5.2 (inc) to 4.5.6 (inc)
nicolargo glances 4.5.6
glances glances From 4.5.2 (inc) to 4.5.6 (exc)
glances glances 4.5.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an OS command injection vulnerability in the Glances monitoring tool. It occurs because the fix for a previous vulnerability (CVE-2026-32608) was incomplete. The sanitizer function failed to properly handle nested values like the process 'cmdline' field, which is a list controlled by attacker-controlled process arguments. This allowed pipe characters to remain unsanitized and be executed by the system when rendered in action templates.

Detection Guidance

Check Glances version with 'glances --version'. If running 4.5.2 to 4.5.6, the system is vulnerable. Inspect action templates for nested stat fields like 'cmdline' that may render pipe characters unsanitized.

Impact Analysis

If you use Glances versions 4.5.2 to 4.5.6, a local unprivileged user could exploit this to execute arbitrary commands with Glances' privileges, typically root. This requires a configured alert action that renders nested stat fields like 'cmdline' in a Mustache template.

Compliance Impact

This vulnerability allows local unprivileged users to execute arbitrary commands with Glances' privileges, typically root, due to incomplete sanitization of nested values like process cmdline fields. This could lead to unauthorized data access, modification, or exfiltration, violating GDPR's integrity and confidentiality requirements and HIPAA's access controls and integrity safeguards.

Mitigation Strategies

Upgrade Glances to version 4.5.6 or later. If upgrading is not possible, disable action templates that render nested stat fields or apply the recursive sanitization patch manually from the commit ea4cf2f.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62982. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart