Glances exposes a SQL injection flaw in its TimescaleDB export module when constructing queries via string concatenation with unsanitized monitoring data. The normalize() method only wraps values in single quotes and does not escape embedded quotes, allowing attacker‑controlled data such as process names or mount points to inject arbitrary SQL. This weakness falls under code that can lead to data manipulation or disclosure if exploited.

The vulnerability affects nicolargo Glances versions prior to 4.5.1 on any platform that uses the TimescaleDB export feature. Attackers can trigger it through any monitored entity, including process names, filesystem mount points, network interface names, or container names.

With a CVSS score of 7.3 the vulnerability is considered high severity, yet the EPSS score is less than 1 % and the issue is not listed in the KEV catalog, indicating a very low probability of exploitation in the wild. Based on the description, it is inferred that the attacker would need to influence system monitoring data, which could be possible in environments where Glances is running with elevated privileges or where user input is reflected in monitored names. Successful exploitation would enable arbitrary SQL execution within the TimescaleDB database, potentially exposing or altering stored metrics.