https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:31:04 +0000 https://cve.radiocsirt.org/vuln/brew-glances-cve-2026-68519 <p><strong>Affected:</strong> Homebrew: glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.</p> <p><strong>Affected:</strong> Homebrew: glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.</p> https://cve.radiocsirt.org/vuln/brew-glances-cve-2026-68519 https://cve.radiocsirt.org/vuln/cve-2026-68519 <p><strong>Affected:</strong> nicolargo glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.</p> <p><strong>Affected:</strong> nicolargo glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.</p> https://cve.radiocsirt.org/vuln/cve-2026-68519 https://cve.radiocsirt.org/vuln/ghsa-59fj-m2j6-hcxh <p><strong>Affected:</strong> PyPI: glances</p> <p>## Summary In Glances 4.5.5 the `--disable-config-exec` flag was extended (GHSA-3vwc-qwhc-3mj7) to stop `secure_popen()` from interpreting the shell operators `&amp;&amp;`, `|` and `&gt;` in **AMP** command values taken from the configuration file. The hardening was not applied to the **on-alert action** command path, which reads its command lines from the same configuration file. As a result, with `--disable-config-exec` enabled, a configured alert action that contains `&gt;` (file redirection), `&amp;&amp;` (chaining) or `|` (pipe) still has those operators interpreted, allowing arbitrary file write / command chaining at the privilege of the glances process when the alert triggers.</p> <p>## Affected code `glances/actions.py` (Glances 4.5.5, latest): ```python ret = secure_popen(cmd_full) # line 111 — no allow_operators=, defaults to True ``` By contrast the AMP modules were fixed: ```python # glances/amps/default/__init__.py:69 self.set_result(secure_popen(res, allow_operators=self.allow_operators()).rstrip()) # glances/amps/systemv/__init__.py:60 res = secure_popen(self.get(&#39;service_cmd&#39;), allow_operators=self.allow_operators()) ```</p> <p>## PoC (benign) `glances.conf`: ```ini [cpu] user_critical=1 user_critical_action=echo MARKER &gt; /tmp/poc_marker ``` Run `glances --disable-config-exec` and generate CPU load. When the cpu `user` alert reaches CRITICAL, `/tmp/poc_marker` is created — i.e. the `&gt;` operator was interpreted despite `--disable-config-exec`. The same `&gt;` in an `[amp_*]` `command` valu…</p> <p><strong>Affected:</strong> PyPI: glances</p> <p>## Summary In Glances 4.5.5 the `--disable-config-exec` flag was extended (GHSA-3vwc-qwhc-3mj7) to stop `secure_popen()` from interpreting the shell operators `&amp;&amp;`, `|` and `&gt;` in **AMP** command values taken from the configuration file. The hardening was not applied to the **on-alert action** command path, which reads its command lines from the same configuration file. As a result, with `--disable-config-exec` enabled, a configured alert action that contains `&gt;` (file redirection), `&amp;&amp;` (chaining) or `|` (pipe) still has those operators interpreted, allowing arbitrary file write / command chaining at the privilege of the glances process when the alert triggers.</p> <p>## Affected code `glances/actions.py` (Glances 4.5.5, latest): ```python ret = secure_popen(cmd_full) # line 111 — no allow_operators=, defaults to True ``` By contrast the AMP modules were fixed: ```python # glances/amps/default/__init__.py:69 self.set_result(secure_popen(res, allow_operators=self.allow_operators()).rstrip()) # glances/amps/systemv/__init__.py:60 res = secure_popen(self.get(&#39;service_cmd&#39;), allow_operators=self.allow_operators()) ```</p> <p>## PoC (benign) `glances.conf`: ```ini [cpu] user_critical=1 user_critical_action=echo MARKER &gt; /tmp/poc_marker ``` Run `glances --disable-config-exec` and generate CPU load. When the cpu `user` alert reaches CRITICAL, `/tmp/poc_marker` is created — i.e. the `&gt;` operator was interpreted despite `--disable-config-exec`. The same `&gt;` in an `[amp_*]` `command` valu…</p> https://cve.radiocsirt.org/vuln/ghsa-59fj-m2j6-hcxh