CVE-2026-62982: Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by securepopen() through administrator-configured action templates. This issue is fixed in 4.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
glancesto a version that resolves this vulnerability.Fixed in 4.5.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62982?
The severity of CVE-2026-62982 is high, with a score of 8.8.
What vulnerability does CVE-2026-62982 address?
CVE-2026-62982 addresses a vulnerability in Glances that allows OS command injection due to an incomplete fix of a previous vulnerability.
How can I mitigate CVE-2026-62982?
To mitigate CVE-2026-62982, upgrade to Glances version 4.5.6 or later where the issue has been addressed.
What type of attack is facilitated by CVE-2026-62982?
CVE-2026-62982 facilitates OS command injection attacks by allowing pipe characters to bypass the sanitizer.
Which versions of Glances are affected by CVE-2026-62982?
Glances versions from 4.5.2 to 4.5.6 are affected by CVE-2026-62982.