CVE-2026-46607 Details
Description
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path — through any of several realistic local or container-level scenarios — can plant a malicious pickle file and achieve arbitrary code execution as the OS user running Glances the next time it starts with version checking enabled (the default). This vulnerability is fixed in 4.5.5.
A vulnerability exists in Glances, an open-source cross-platform system monitoring tool, prior to version 4.5.5. The issue arises in the 'glances/outdated.py' file, where 'pickle.load()' is used to read a version-check cache file. This file is stored at a predictable, world-accessible path without any integrity check, signature verification, or format validation before deserialization. An attacker with write access to this path can inject a malicious pickle file that executes arbitrary code as the user running Glances, the next time the application is launched with version checking enabled, which is the default setting.
Users should update Glances to version 4.5.5 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nicolargo/glances/security/advisories/GHSA-9837-48hr-q32j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nicolargo/glances/releases/tag/v4.5.5 | [email protected] | Release NotesVendor |
| https://github.com/nicolargo/glances/security/advisories/GHSA-9837-48hr-q32j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Glances | <= 4.5.5_dev1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | New CVE Received | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |