Glances, the popular system monitoring tool, has a command injection vulnerability in version 4.5.2 and earlier. CVE-2026-33641 carries a CVSS score of 7.8 (High).
The flaw sits in the configuration parser. When Config.get_value() reads values, it searches for substrings enclosed in backticks and executes them as system commands via system_exec(). That function calls subprocess.run() on whatever’s between the backticks. There’s no validation. No sanitization. No restriction on what commands can run.
If an attacker can modify or influence a Glances configuration file, arbitrary commands execute automatically when the service starts or reloads its config. When Glances runs with elevated privileges — common when deployed as a system service — this becomes a privilege escalation vector.
The fix landed in version 4.5.3. The vulnerable code is in glances/config.py and glances/globals.py. A proof-of-concept demonstrates the issue by creating a config file with `touch /tmp/glances_pwned` as a value — the file appears on disk the moment Glances parses it.
Check your versions. If you’re running Glances ≤ 4.5.2, especially as a privileged service, patch to 4.5.3 now. And restrict who can write to your config files.
