Vulnerability · Published Jun 25, 2026 · Assigned by GitHub_M
CVE-2026-46607Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution
High 7.8
In plain English
A high-severity unsafe deserialization in glances from nicolargo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path — through any of several realistic local or container-level scenarios — can plant a malicious pickle file and achieve arbitrary code execution as the OS user running Glances the next time it starts with version checking enabled (the default). This vulnerability is fixed in 4.5.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | glances | no fix listed | DEBIAN-CVE-2026-46607 |
| Debian:13 | glances | no fix listed | DEBIAN-CVE-2026-46607 |
| Debian:14 | glances | 4.5.5+dfsg-1 | DEBIAN-CVE-2026-46607 |
| PyPI | glances | 4.5.5 | GHSA-9837-48hr-q32j |
| PyPI | glances | 4.5.5 | PYSEC-2026-2496 |
| Ubuntu:22.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-46607 |
| Ubuntu:24.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-46607 |
| Ubuntu:25.10 | glances | no fix listed | UBUNTU-CVE-2026-46607 |
| Ubuntu:26.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-46607 |
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/nicolargo/glances/security/advisories/GHSA-9837-48hr-q32j x_refsource_CONFIRM
- https://github.com/nicolargo/glances/releases/tag/v4.5.5 x_refsource_MISC