CVE-2026-62982

Name of the Vulnerable Software and Affected Versions Glances versions 4.5.2 through 4.5.5

Description An issue exists where the sanitize mustache dict() function in glances/actions.py only sanitizes top-level string values, skipping nested lists and dictionaries. This allows shell operators, specifically the pipe character |, to persist in nested data such as the process cmdline variable. When an administrator-configured action template renders these nested values using chevron.render(), the pipe character is not escaped and is subsequently executed by secure popen(). A local unprivileged user can exploit this by launching a process with a specially crafted cmdline argument, leading to arbitrary OS command execution within the security context of Glances, which typically runs as root.

Recommendations Update Glances to version 4.5.6. As a temporary workaround, avoid using action templates that render nested stat fields, such as the process cmdline variable.