CVE-2026-68518

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6

Description An issue exists in the action system where an administrator can configure shell commands to run when monitoring thresholds are crossed. These commands use Mustache templates that are filled with runtime stat fields, such as process or container names, which can be influenced by a local unprivileged user.

The function sanitize mustache dict() in glances/actions.py attempts to prevent command injection by stripping shell operators from individual template values. However, it does not strip single characters like &. When an action template concatenates two unescaped Mustache variables (using {{{ }}} or {{& }}) and the first value ends with & while the second begins with &, a literal && operator is reconstructed after rendering. This reconstructed operator is then executed by secure popen(), allowing for arbitrary command execution, file redirection, or output piping as the user running Glances.

Recommendations Update Glances to version 4.5.6. As a temporary workaround, avoid using unescaped Mustache variables ({{{ }}} or {{& }}) in action templates, especially when they are placed adjacent to each other.