CVE-2026-53925: Glances 4.0.8–4.5.4 Arbitrary Command Execution via Unvalidated Configuration

Technical summary

The secure_popen() function in glances/secure.py processes command strings from the Application Monitoring Process (AMP) module configuration without sanitizing shell metacharacters. Specifically, the > (output redirection), | (pipe), and && (command chaining) operators are interpreted and executed by the underlying shell. When AMP modules read their command and service_cmd values from glances.conf, these unsanitized strings are passed directly to secure_popen(). An attacker capable of modifying glances.conf can inject shell operators to write arbitrary content to filesystem paths, execute additional commands in sequence, or route command output to attacker-controlled programs. The vulnerability affects all releases from 4.0.8 through 4.5.4; version 4.5.5 and later contain the fix.

Business impact

In environments where Glances runs with elevated privileges or where multiple users share access to configuration files, this vulnerability enables privilege escalation or lateral movement. An attacker could overwrite critical application or system files, plant backdoors, exfiltrate monitoring data, or disrupt service availability. For organizations relying on Glances in production monitoring stacks, this creates an urgent remediation need, particularly in containerized deployments where configuration management may be less restricted.

Affected systems

Glances versions 4.0.8 through 4.5.4 are affected. The vulnerability is present across all supported platforms (Linux, macOS, Windows) where Glances runs. Risk is highest where: (1) Glances operates with elevated or service-level privileges, (2) configuration files are writable by lower-privileged users or exposed in shared environments, (3) Glances is deployed in container orchestration platforms with loose file permission controls.

Exploitability

Exploitation requires local file access to modify glances.conf, limiting this to authenticated local users or container escape scenarios. The attack requires no user interaction and succeeds immediately upon Glances restart or configuration reload. The barrier to exploitation is moderate for insiders or compromised accounts but low for anyone with write access to the config directory. No network component; this is a pure local privilege escalation or data integrity attack.

Remediation

Upgrade Glances to version 4.5.5 or later immediately. Prior to upgrade, restrict write permissions on glances.conf to the Glances service account only and audit recent configuration changes for signs of tampering. For organizations unable to upgrade immediately, disable or remove AMP module commands from the configuration and rely on native Glances sensors until patching is complete.

Patch guidance

Update Glances via your package manager (pip, apt, brew, etc.) to 4.5.5 or newer. Verify the installed version with `glances --version`. If Glances is containerized, rebuild container images from updated base package versions. No configuration changes are required post-patch, but review glances.conf for any suspicious command entries that may have been injected prior to patching.

Detection guidance

Monitor for modification timestamps on glances.conf files, particularly changes made by non-service accounts. Log and alert on Glances configuration reload events, especially if followed by unexpected file writes or child process spawning. Inspect glances.conf for unusual shell metacharacters (>, |, &&) in command or service_cmd fields—these are rarely legitimate in monitoring configurations. Review system audit logs for file writes to sensitive directories coinciding with Glances process execution.

Why prioritize this

Although exploitation requires local access, the severity is high due to the scope of impact (arbitrary file write and command execution) combined with the high likelihood of successful exploitation once access is obtained. In shared or containerized environments, this represents a critical privilege escalation vector. The fix is straightforward and low-risk, warranting rapid deployment.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects high impact (confidentiality, integrity, availability all affected), low attack complexity, and local attack vector. The score appropriately accounts for the requirement of local privilege (PR:L) but correctly weights the severity of unrestricted file system and command execution once that privilege is leveraged.

Frequently asked questions