CVE-2026-46606 Details
Description
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.
A command injection vulnerability has been identified in the Glances monitoring tool, specifically within the KVM/QEMU monitoring engine. This issue affects versions of Glances prior to 4.5.5. The vulnerability arises because VM domain names, taken directly from the 'virsh list --all' output, are passed into f-string command templates without proper sanitization. The 'secure_popen()' function, which processes these commands, is designed to interpret shell operators such as '&&', '|', and '>' as command control characters. As a result, any user with the ability to create or rename KVM/QEMU virtual machines can execute arbitrary commands as the operating system user running Glances, typically with root privileges on hypervisor hosts.
Users can update to Glances version 4.5.5, where this vulnerability has been fixed. For those using version 4.5.5_dev1, it is recommended to sanitize domain names before interpolation or to use list-based argument passing with 'subprocess.run' to avoid command injection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nicolargo/glances/releases/tag/v4.5.5 | [email protected] | Release NotesVendor |
| https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Glances | <= 4.5.5_dev1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | New CVE Received | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |