Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-68518: Glances lets attackers run commands via action templates

CVE-2026-68518 · published 2 months ago

Summary

The monitoring tool Glances (versions before 4.5.6) can rebuild shell commands when a specially crafted template is used. An attacker who can influence the data shown in the template could cause the program to execute unwanted commands on the system. Upgrade Glances to version 4.5.6 or later to stop this behavior.

What to do

Update nicolas hennion glances to version 4.5.6.
Update debian glances to version 4.5.6+dfsg-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:13	debian	glances	All versions
–	nicolargo	glances	< 4.5.6
pip	nicolas hennion	glances	<= 4.5.5 Fix: upgrade to 4.5.6
Debian:12	debian	glances	All versions
Debian:14	debian	glances	< 4.5.6+dfsg-1 Fix: upgrade to 4.5.6+dfsg-1
PyPI	nicolas hennion	glances	< 4.5.6 Fix: upgrade to 4.5.6

Original advisory text

Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure_popen() executes when attacker-controlled process or container fields are rendered by an administrator-configured action template. This issue is fixed in 4.5.6.

References

https://github.com/nicolargo/glances/releases/tag/v4.5.6 URL
https://github.com/nicolargo/glances/security/advisories/GHSA-qcpp-8x79-hhp3 Vendor Advisory
https://github.com/advisories/GHSA-qcpp-8x79-hhp3
https://security-tracker.debian.org/tracker/CVE-2026-68518 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68518... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-68518 Vendor Advisory
https://github.com/nicolargo/glances Product
https://pypi.org/project/glances Product
https://github.com/nicolargo/glances/commit/9c280eae5419da680827024b60f6265956e3... Patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published17 Aug 2026

Updated26 Oct 2026

First seen17 Aug 2026

Sources

DEBIAN-CVE-2026-68518 · OSV

CVE-2026-68518 · NVD

CVE-2026-68518 · MITRE

GHSA-qcpp-8x79-hhp3 · GHSA

CVE-2026-68518 · OSV

PYSEC-2026-3668 · OSV

Track software like this

Free during beta