Description

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by secure_popen() through administrator-configured action templates. This issue is fixed in 4.5.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-17T18:17:56.740Z",
  "pubdate": "2026-08-17T18:17:56.740Z",
  "executiveSummary": "A validation bypass vulnerability exists in the Glances cross-platform monitoring tool, specifically affecting versions 4.5.2 through 4.5.6. The flaw resides within the _sanitize_mustache_dict() function located in glances/actions.py. This vulnerability is classified as an input sanitization failure leading to potential command execution under administrator-configured action templates. The impact of this security deficiency allows pipe characters to evade sanitization mechanisms and survive chevron.render() operations, subsequently being passed to secure_popen() for execution. Affected systems include installations running the vulnerable version range where mustache-based action templates are actively utilized by administrators. The risk implications are severe, as an attacker capable of manipulating input data that populates nested lists and dictionaries—such as process command-line arguments—can leverage this behavior to inject malicious commands. Exploitation requirements mandate that the target system utilizes administrator-configured action templates that process unsanitized mustache parameters, intersecting with inputs containing specific process metadata.",
  "technicalDetails": "The root cause of the vulnerability stems from incomplete input sanitization within the _sanitize_mustache_dict() function in glances/actions.py. Specifically, the sanitization logic fails to adequately inspect and clean nested lists and dictionary strings, such as those representing process command-line values. Consequently, critical metacharacters like pipe characters are permitted to bypass filtering routines. During template processing, these unsanitized strings are passed to chevron.render(), where mustache templating expands the variables without stripping the malicious control characters. Following the rendering phase, the resulting string is supplied to secure_popen(), which executes the command stream. The attack flow initiates when an attacker crafts or induces a process with a malicious command-line argument containing pipe characters designed to manipulate the execution flow. As Glances monitors system activity, it captures this process metadata and incorporates it into internal dictionaries and lists processed by the vulnerable _sanitize_mustache_dict() function. Because nested structures are skipped during sanitization, the injected pipe characters survive the mustache rendering engine untouched. When an administrator-configured action template is triggered, the rendered output containing the embedded command injection vector is handed off to secure_popen(). This execution path results in arbitrary command execution within the context of the running Glances process, depending on the privileges assigned to the monitoring daemon. The vulnerable component is the glances/actions.py script, impacting software versions 4.5.2 to 4.5.6. Authentication and privilege requirements vary based on the deployment configuration, but successful exploitation typically requires the ability to spawn processes with specific command-line arguments monitored by Glances, coupled with the presence of administrator-configured action templates that execute system commands based on rendered templates."
}