CyberRota Analysis
AI-GeneratedGlances, an open-source system monitoring tool, is vulnerable to a high-severity issue that allows attackers to exploit adjacent unescaped Mustache variables, potentially reconstructing shell operators executed by the secure_popen() function when rendering administrator-configured action templates. This vulnerability can lead to arbitrary command execution in environments where user-controlled process or container fields are processed. Organizations using versions prior to 4.5.6 should prioritize updating to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure_popen() executes when attacker-controlled process or container fields are rendered by an administrator-configured action template. This issue is fixed in 4.5.6.