CVE-2026-62982: Glances Monitoring Tool RCE Vulnerability

CVE-2026-62982 is a remote code execution flaw in Glances open-source monitoring tool affecting versions 4.5.2 to 4.5.5. Attackers can exploit command injection through action templates to execute arbitrary code. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-62982 Overview

CVE-2026-62982 is a command injection vulnerability in Glances, an open-source cross-platform system monitoring tool. The flaw exists in _sanitize_mustache_dict() within glances/actions.py and affects versions 4.5.2 through 4.5.5. The sanitizer skips nested list and dictionary values such as process cmdline entries, allowing shell metacharacters like the pipe (|) to survive chevron.render() and reach secure_popen(). An attacker who can control a monitored process command line can inject shell operators into administrator-configured action templates. This is an incomplete fix of CVE-2026-32608 [CWE-78].

Critical Impact
A local attacker capable of spawning a process with a crafted argv can inject shell commands executed by Glances through configured action templates.

Affected Products

Glances 4.5.2
Glances 4.5.3 through 4.5.5
Fixed in Glances 4.5.6

Discovery Timeline

2026-08-17 - CVE-2026-62982 published to NVD
2026-08-17 - Last updated in NVD database

Technical Details for CVE-2026-62982

Vulnerability Analysis

Glances supports administrator-defined action templates that run shell commands when monitored metrics cross a threshold. Templated values are rendered with chevron (Mustache) and passed to secure_popen(). Before rendering, _sanitize_mustache_dict() replaces shell operators (&&, |, >>, >) with spaces to prevent operator injection. The pre-patch sanitizer only inspected top-level string values in the dictionary and left nested containers untouched. Process metadata such as cmdline, exposed as a list of argv strings, therefore reached the renderer unmodified. Mustache does not HTML-escape the pipe character, so any operator present in a nested string survives into the final command line executed by secure_popen().

Root Cause

The root cause is incomplete input sanitization in _sanitize_mustache_dict(). The function iterated only over top-level values in the mustache context and did not recurse into lists, tuples, or nested dictionaries. Attacker-controlled data reachable through psutil process fields bypassed the operator-stripping logic.

Attack Vector

Exploitation requires local access with the ability to start a process on the monitored host. The attacker crafts a process argument vector containing shell operators. When the administrator has configured an action template that references process fields (for example {{cmdline}}), Glances renders the malicious argv into the command string. secure_popen() then invokes a shell that interprets the injected operator, running attacker commands with the privileges of the Glances process.

python

# Security patch in glances/actions.py (source: GitHub commit ea4cf2f)
_SHELL_OPERATORS = ('&&', '|', '>>', '>')


def _sanitize_value(value):
    """Replace shell operators by spaces in a string, recursing into containers."""
    if isinstance(value, str):
        for op in _SHELL_OPERATORS:
            value = value.replace(op, ' ')
        return value
    if isinstance(value, (list, tuple)):
        return type(value)(_sanitize_value(item) for item in value)
    if isinstance(value, dict):
        return {k: _sanitize_value(v) for k, v in value.items()}
    return value

Source: GitHub Commit ea4cf2f. The patch introduces recursion so that nested strings inside lists, tuples, and dicts are sanitized before being passed to the Mustache renderer.

Detection Methods for CVE-2026-62982

Indicators of Compromise

Unexpected child processes spawned by the Glances process (glances, python -m glances) that do not correspond to configured actions.
Processes on the host started with argv containing shell operators such as |, &&, >, or >>.
Modifications to glances.conf action templates that reference {{cmdline}}, {{name}}, or other process fields.

Detection Strategies

Inventory Glances installations and flag any running version between 4.5.2 and 4.5.5.
Monitor process creation events where the parent is a Glances process and the command line contains shell metacharacters.
Review Glances configuration files for action templates that interpolate process-derived fields into shell commands.

Monitoring Recommendations

Enable process-creation and command-line logging on hosts running Glances and forward events to a central analytics platform.
Alert on Glances child processes that invoke shells (sh -c, bash -c) with argv containing operator characters.
Track file integrity on glances.conf and any include files defining action templates.

How to Mitigate CVE-2026-62982

Immediate Actions Required

Upgrade Glances to version 4.5.6 or later on all monitored hosts.
Audit glances.conf for action templates and remove or restrict any that interpolate process fields into shell commands.
Restrict which local users can start processes on hosts where Glances runs with elevated privileges.

Patch Information

The vulnerability is fixed in Glances 4.5.6. See the GitHub Security Advisory GHSA-73wf-9vmv-5pv9 and the Glances v4.5.6 release notes. The fix adds recursive sanitization of nested container values before Mustache rendering.

Workarounds

Disable action templates entirely by removing action directives from glances.conf until the upgrade is applied.
Run Glances under a low-privilege service account so that any injected command inherits minimal permissions.
Constrain templates to metric values (numeric fields) rather than process metadata such as cmdline or name.

bash

# Upgrade Glances to the patched release
pip install --upgrade 'glances>=4.5.6'

# Verify installed version
glances --version