CVE-2026-68519

EUVD-2026-60305
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
7.1 HIGH
LOCAL
LOW
HIGH
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 6.62%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nicolargoglances
𝑥
< 4.5.6
CNA
Debian logo
Debian Releases
Debian Product
Codename
glances
bookworm
3.3.1.1+dfsg-1
fixed
forky
4.5.6+dfsg-1
fixed
sid
4.5.6+dfsg-1
fixed
trixie
4.3.1+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
glances
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/nicolargo/glances/commit/5c07c0d96423e9d5b9de71dd92e3717c66f504bd
https://github.com/nicolargo/glances/releases/tag/v4.5.6
https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh
https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh