Glances, an open-source system monitoring tool, allows administrators to configure shell commands that run when thresholds are breached. These commands use Mustache template variables that are replaced with runtime data. Prior to version 4.5.2 the secure_popen() routine would split a command string on pipe, redirect, or chain metacharacters before invoking subprocess.Popen(shell=False). When a template value such as a process name contains these characters, the command is split in unintended ways, enabling an attacker who can control a process name or container name to inject arbitrary shell commands (CWE‑78). The impact is the ability for an attacker to execute arbitrary commands on the host system, potentially compromising confidentiality, integrity, and availability.

The vulnerable product is nicolargo:Glances. All versions prior to 4.5.2 are affected. This includes the CPE cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*. Users running these earlier releases should be aware of the risk.

The CVSS score is 7, indicating high severity, while the EPSS score is below 1 %, suggesting exploitation is unlikely as of now. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to influence process or container names that are referenced in action command templates, which can be achieved locally or remotely if an attacker can create such names. The insecure handling of mustache-rendered values allows command splitting, providing a code execution path once the condition is met.