CVE-2026-33641 Details

A command injection vulnerability has been identified in Glances, a cross-platform system monitoring tool, prior to version 4.5.3. The issue arises from the application's dynamic configuration feature, which allows substrings enclosed in backticks to be executed as system commands during the parsing of configuration files. This behavior, found in the 'Config.get_value()' method, is implemented without any validation or restrictions on the commands being executed. As a result, if an attacker can modify or influence the configuration files, arbitrary commands could be executed automatically with the privileges of the Glances process, potentially leading to privilege escalation, especially in environments where Glances is run as a system service with elevated rights.

Users can update to Glances version 4.5.3 or later, where this vulnerability has been patched.