CVE-2026-53925

Name of the Vulnerable Software and Affected Versions glances (affected versions not specified)

Description The secure popen() function in glances/secure.py improperly interprets shell-like operators, specifically > (file redirection), | (pipe), and && (command chaining), within command strings. When Application Monitoring Process (AMP) modules load command or service cmd configuration values from glances.conf, these values are passed to secure popen() without sanitization. This allows an attacker who can modify the configuration file to write arbitrary content to any filesystem path, chain arbitrary commands, or pipe output to other programs.

Technical details include:

The --disable-config-exec flag does not mitigate this issue as it only prevents backtick execution in config.get value() and does not affect how secure popen() processes the resulting strings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the glances.conf file to prevent unauthorized modification of AMP command and service cmd values. Avoid using the > , | , and && operators within the AMP configuration values.