https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:28:07.313411+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-15320 bdu:2026-15320 2026-10-03T15:28:07.435997+00:00 bdu:2026-15320 https://cve.radiocsirt.org/vuln/brew-glances-cve-2026-46606 BREW-glances-CVE-2026-46606 — Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py 2026-10-03T15:28:07.436037+00:00

Affected: Homebrew: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.

 https://cve.radiocsirt.org/vuln/euvd-2026-330374 EUVD-2026-330374 2026-10-03T15:28:07.436081+00:00 EUVD-2026-330374 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46606 fkie_cve-2026-46606 2026-10-03T15:28:07.436096+00:00

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.

 https://cve.radiocsirt.org/vuln/ghsa-v5r2-qh84-fjx5 GHSA-v5r2-qh84-fjx5 — Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py 2026-10-03T15:28:07.436124+00:00

Affected: PyPI: glances

### Summary

The Glances KVM/QEMU monitoring engine (`glances/plugins/vms/engines/virsh.py`) passes VM domain names, read directly from `virsh list --all` output, into f-string command templates that are processed by `secure_popen()`. `secure_popen()` is explicitly designed to interpret `&&`, `|`, and `>` as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts.

---

### Details

**Affected file:** `glances/plugins/vms/engines/virsh.py`

**Direct URLs (commit 04579778e733d705898a169e049dc84772c852da):** - https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L185 - https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L204

The vulnerable calls are on lines 185 and 204:

```python # line 185 (update_stats) ret_cmd = secure_popen(f'{VIRSH_PATH} {VIRSH_DOMAIN_STATS_OPTIONS} {domain}')

# line 204 (update_title) ret_cmd = secure_popen(f'{VIRSH_PATH} {VIRSH_DOMAIN_TITLE_OPTIONS} {domain}') ```

`domain` is the name string parsed from the output of `virsh list --all` (line 59–78 in the same file); no sanitisation is applied to it at any point before it reaches `secure_popen()`.

`secure_popen()` is defined in `glances/secure.py`. It explicitly splits…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11122-1 openSUSE-SU-2026:11122-1 — glances-common-4.5.5-1.1 on GA media 2026-10-03T15:28:07.436197+00:00

glances-common-4.5.5-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-2497 PYSEC-2026-2497 — Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py 2026-10-03T15:28:07.436220+00:00

Affected: PyPI: glances

### Summary

The Glances KVM/QEMU monitoring engine (`glances/plugins/vms/engines/virsh.py`) passes VM domain names, read directly from `virsh list --all` output, into f-string command templates that are processed by `secure_popen()`. `secure_popen()` is explicitly designed to interpret `&&`, `|`, and `>` as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts.

---

### Details

**Affected file:** `glances/plugins/vms/engines/virsh.py`

**Direct URLs (commit 04579778e733d705898a169e049dc84772c852da):** - https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L185 - https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/plugins/vms/engines/virsh.py#L204

The vulnerable calls are on lines 185 and 204:

```python # line 185 (update_stats) ret_cmd = secure_popen(f'{VIRSH_PATH} {VIRSH_DOMAIN_STATS_OPTIONS} {domain}')

# line 204 (update_title) ret_cmd = secure_popen(f'{VIRSH_PATH} {VIRSH_DOMAIN_TITLE_OPTIONS} {domain}') ```

`domain` is the name string parsed from the output of `virsh list --all` (line 59–78 in the same file); no sanitisation is applied to it at any point before it reaches `secure_popen()`.

`secure_popen()` is defined in `glances/secure.py`. It explicitly splits…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-46606 UBUNTU-CVE-2026-46606 2026-10-03T15:28:07.436283+00:00

Affected: Ubuntu:Pro:16.04:LTS: glances, Ubuntu:Pro:18.04:LTS: glances, Ubuntu:Pro:20.04:LTS: glances, Ubuntu:22.04:LTS: glances, Ubuntu:24.04:LTS: glances, Ubuntu:25.10: glances, Ubuntu:26.04:LTS: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.