GHSA-59FJ-M2J6-HCXH

Vulnerability from github – Published: 2026-08-17 17:20 – Updated: 2026-08-17 17:20
VLAI
Summary
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
Details

Summary

In Glances 4.5.5 the --disable-config-exec flag was extended (GHSA-3vwc-qwhc-3mj7) to stop secure_popen() from interpreting the shell operators &&, | and > in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its command lines from the same configuration file. As a result, with --disable-config-exec enabled, a configured alert action that contains > (file redirection), && (chaining) or | (pipe) still has those operators interpreted, allowing arbitrary file write / command chaining at the privilege of the glances process when the alert triggers.

Affected code

glances/actions.py (Glances 4.5.5, latest):

ret = secure_popen(cmd_full)        # line 111 — no allow_operators=, defaults to True

By contrast the AMP modules were fixed:

# glances/amps/default/__init__.py:69
self.set_result(secure_popen(res, allow_operators=self.allow_operators()).rstrip())
# glances/amps/systemv/__init__.py:60
res = secure_popen(self.get('service_cmd'), allow_operators=self.allow_operators())

PoC (benign)

glances.conf:

[cpu]
user_critical=1
user_critical_action=echo MARKER > /tmp/poc_marker

Run glances --disable-config-exec and generate CPU load. When the cpu user alert reaches CRITICAL, /tmp/poc_marker is created — i.e. the > operator was interpreted despite --disable-config-exec. The same > in an [amp_*] command value is correctly not interpreted.

Impact

Arbitrary file write (>), command chaining (&&) and pipe (|) from config-defined alert actions, contrary to the guarantee of --disable-config-exec. Trust boundary = the glances configuration file.

Suggested fix

Pass allow_operators=not args.disable_config_exec from GlancesActions.run() into secure_popen() (GlancesActions already holds args).

Credit

Reported via responsible-disclosure incomplete-fix measurement study.

Severity
7.1 (High)
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.5.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68519"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T17:20:37Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nIn Glances 4.5.5 the `--disable-config-exec` flag was extended (GHSA-3vwc-qwhc-3mj7) to stop `secure_popen()` from\ninterpreting the shell operators `\u0026\u0026`, `|` and `\u003e` in **AMP** command values taken from the configuration file. The\nhardening was not applied to the **on-alert action** command path, which reads its command lines from the same\nconfiguration file. As a result, with `--disable-config-exec` enabled, a configured alert action that contains `\u003e`\n(file redirection), `\u0026\u0026` (chaining) or `|` (pipe) still has those operators interpreted, allowing arbitrary file\nwrite / command chaining at the privilege of the glances process when the alert triggers.\n\n## Affected code\n`glances/actions.py` (Glances 4.5.5, latest):\n```python\nret = secure_popen(cmd_full)        # line 111 \u2014 no allow_operators=, defaults to True\n```\nBy contrast the AMP modules were fixed:\n```python\n# glances/amps/default/__init__.py:69\nself.set_result(secure_popen(res, allow_operators=self.allow_operators()).rstrip())\n# glances/amps/systemv/__init__.py:60\nres = secure_popen(self.get(\u0027service_cmd\u0027), allow_operators=self.allow_operators())\n```\n\n## PoC (benign)\n`glances.conf`:\n```ini\n[cpu]\nuser_critical=1\nuser_critical_action=echo MARKER \u003e /tmp/poc_marker\n```\nRun `glances --disable-config-exec` and generate CPU load. When the cpu `user` alert reaches CRITICAL, `/tmp/poc_marker`\nis created \u2014 i.e. the `\u003e` operator was interpreted despite `--disable-config-exec`. The same `\u003e` in an `[amp_*]`\n`command` value is correctly *not* interpreted.\n\n## Impact\nArbitrary file write (`\u003e`), command chaining (`\u0026\u0026`) and pipe (`|`) from config-defined alert actions, contrary to the\nguarantee of `--disable-config-exec`. Trust boundary = the glances configuration file.\n\n## Suggested fix\nPass `allow_operators=not args.disable_config_exec` from `GlancesActions.run()` into `secure_popen()` (GlancesActions\nalready holds `args`).\n\n## Credit\nReported via responsible-disclosure incomplete-fix measurement study.",
  "id": "GHSA-59fj-m2j6-hcxh",
  "modified": "2026-08-17T17:20:37Z",
  "published": "2026-08-17T17:20:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/commit/5c07c0d96423e9d5b9de71dd92e3717c66f504bd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nicolargo/glances"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.