CVE-2026-46606

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.5

Description The KVM/QEMU monitoring engine in the glances/plugins/vms/engines/virsh.py file fails to sanitize VM domain names retrieved from the virsh list --all output. These names are passed into f-string command templates processed by the secure popen() function. Because secure popen() is designed to interpret &&, |, and > as shell operators, a user with permissions to create or rename a KVM/QEMU virtual machine can inject these operators into the domain name to execute arbitrary commands. This execution occurs with the privileges of the OS user running Glances, which is frequently root on hypervisor hosts.

Recommendations Update to version 4.5.5. As a temporary mitigation, restrict permissions to create or rename KVM/QEMU virtual machines to trusted users only. Run Glances under a dedicated low-privilege service account instead of root to limit the impact of potential exploitation.