{"cve":"CVE-2026-33641","nvd":{"published":"2026-04-02T15:16:40.040","modified":"2026-10-26T22:10:00.163","status":"Analyzed","description":"Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-78"],"references":["https://github.com/nicolargo/glances/commit/358d76a225fc21a9f95d2c4d7e46fafe64a644c6","https://github.com/nicolargo/glances/releases/tag/v4.5.3","https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7","https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7"],"products":["nicolargo:glances"],"source":"nvd","synced_at":"2026-10-26T22:26:44.656832877+00:00"},"epss":{"cve":"CVE-2026-33641","score":0.00869,"percentile":0.58524,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-qhj7-v7h7-q4c7","url":"https://osv.dev/vulnerability/GHSA-qhj7-v7h7-q4c7","summary":"Glances Vulnerable to Command Injection via Dynamic Configuration Values","modified":"2026-07-13T07:26:25.827703490Z","packages":[{"ecosystem":"PyPI","name":"glances","purl":"pkg:pypi/glances","ranges":["<4.5.3"],"fixed":["4.5.3"]}]},{"id":"PYSEC-2026-2174","url":"https://osv.dev/vulnerability/PYSEC-2026-2174","summary":"","modified":"2026-07-13T07:15:31.861124082Z","packages":[{"ecosystem":"PyPI","name":"glances","purl":"pkg:pypi/glances","ranges":["<4.5.3"],"fixed":["4.5.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}