DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-68518: CVE-2026-68518: Command Injection Bypass in Glances via Cross-Field Shell-Operator Reconstruction

#security #cve #cybersecurity

CVE-2026-68518: Command Injection Bypass in Glances via Cross-Field Shell-Operator Reconstruction

Vulnerability ID: CVE-2026-68518
CVSS Score: 8.8
Published: 2026-08-17

A command injection bypass vulnerability exists in the Glances system monitoring tool prior to v4.5.6. This flaw permits an attacker with local process or container metadata control to bypass action-template sanitizers by reconstructing shell execution operators across adjacent unescaped variables. When a system alert triggers a configured action template, the reconstructed operators are evaluated by the underlying shell, leading to arbitrary code execution in the context of the Glances process.

TL;DR

Incomplete sanitization of individual variables allows adjacent unescaped Mustache parameters to combine into a shell command operator (such as '&&'), leading to command execution when the template is rendered and executed.

Technical Details

  • CWE ID: CWE-78
  • Attack Vector: Local
  • CVSS Score: 8.8
  • Exploit Status: none
  • KEV Status: Not Listed

Affected Systems

  • Glances
  • Glances: < 4.5.6 (Fixed in: 4.5.6)

Code Analysis

Commit: 9c280ea

Fix command injection bypass by adding single ampersand to _SHELL_OPERATORS

--- a/glances/actions.py
+++ b/glances/actions.py
@@ -22,7 +22,18 @@

 # Characters that secure_popen interprets as shell operators.
 # Mustache-rendered values must not contain these to prevent command injection.
-_SHELL_OPERATORS = ('&&', '|', '>>', '>')
+#
+# A lone '&' is included even though it is not itself an operator: when two
+# adjacent unescaped Mustache variables ({{{a}}}{{{b}}} / {{&a}}{{&b}}) are
+# rendered next to each other, a trailing '&' from the first value and a leading
+# '&' from the second join into a real '&&' *after* per-field sanitization, which
+# secure_popen would then interpret as a command chain (GHSA-qcpp-8x79-hhp3,
+# incomplete fix of CVE-2026-32608). Stripping the lone '&' from each value
+# removes the operator character on both sides of the variable boundary, so no
+# operator can be reconstructed across it. The multi-character operators stay
+# first so '&&'/'>>' collapse to a single space (stable whitespace, no double
+# strip).
+_SHELL_OPERATORS = ('&&', '|', '>>', '>', '&')
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade Glances to version 4.5.6 or higher to ensure the expanded sanitization blacklist is applied.
  • Modify custom action templates in glances.conf to avoid adjacent, unescaped variables like {{{name}}}{{{cmdline}}}.
  • Configure the Glances service to run with the lowest possible system privileges rather than root.

Remediation Steps:

  1. Identify all systems running Glances versions prior to v4.5.6.
  2. Update the Glances installation package using pip or your operating system's package manager to v4.5.6 or newer.
  3. Audit 'glances.conf' to find any instances of adjacent unescaped variables.
  4. Insert delimiter characters or spaces between consecutive variables in the action template configuration.
  5. Restart the Glances service to apply configuration and software updates.

References

Read the full report for CVE-2026-68518 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)