CyberRota Analysis
AI-GeneratedThe vulnerability affects Glances versions 4.5.2 to 4.5.6, where the _sanitize_mustache_dict() function fails to properly sanitize nested list and dictionary strings, allowing potentially malicious pipe characters to be executed via administrator-configured action templates. This could lead to arbitrary command execution, posing a significant risk to system integrity. Organizations using affected versions of Glances should prioritize upgrading to version 4.5.6 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by secure_popen() through administrator-configured action templates. This issue is fixed in 4.5.6.