Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-33641Glances Vulnerable to Command Injection via Dynamic Configuration Values
High 7.8
In plain English
A high-severity OS command injection in glances from nicolargo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | glances | no fix listed | DEBIAN-CVE-2026-33641 |
| Debian:13 | glances | no fix listed | DEBIAN-CVE-2026-33641 |
| Debian:14 | glances | 4.5.3.2+dfsg-1 | DEBIAN-CVE-2026-33641 |
| PyPI | glances | 4.5.3 | GHSA-qhj7-v7h7-q4c7 |
| PyPI | glances | 4.5.3 | PYSEC-2026-2174 |
| Ubuntu:22.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-33641 |
| Ubuntu:24.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-33641 |
| Ubuntu:25.10 | glances | no fix listed | UBUNTU-CVE-2026-33641 |
| Ubuntu:26.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-33641 |
| Ubuntu:26.10 | glances | no fix listed | UBUNTU-CVE-2026-33641 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7 x_refsource_CONFIRM
- https://github.com/nicolargo/glances/commit/358d76a225fc21a9f95d2c4d7e46fafe64a644c6 x_refsource_MISC
- https://github.com/nicolargo/glances/releases/tag/v4.5.3 x_refsource_MISC