CVE-2026-32611 - Vulnerability Analysis

Overview

Glances contains a SQL injection caused by unescaped table and column names interpolated via f-strings in the DuckDB export module, letting attackers execute arbitrary SQL commands, exploit requires crafted input affecting SQL identifiers.

Severity & Score

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data manipulation or disclosure.

Mitigation

Update to version 4.5.3 or later.

References

• https://github.com/nicolargo/glances/commit/63b7da28895249d775202d639e5531ba63491a5c
• https://github.com/nicolargo/glances/releases/tag/v4.5.2
• https://github.com/nicolargo/glances/security/advisories/GHSA-49g7-2ww7-3vf5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner