CVE-2026-32608 - Vulnerability Analysis

Overview

Glances < 4.5.2 contains a command injection caused by improper splitting of Mustache-rendered shell commands in secure_popen(), letting attackers controlling process or container names execute arbitrary commands remotely, exploit requires attacker control over monitored names.

Severity & Score

Impact

Attackers controlling monitored names can execute arbitrary shell commands, potentially leading to full system compromise.

Mitigation

Update to version 4.5.2 or later.

References

• https://github.com/nicolargo/glances/commit/6f4ec53d967478e69917078e6f73f448001bf107
• https://github.com/nicolargo/glances/releases/tag/v4.5.2
• https://github.com/nicolargo/glances/security/advisories/GHSA-vcv2-q258-wrg7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner