Technical impact
Glances, an open‑source system monitoring tool, has a flaw in the DuckDB export module where table and column names are interpolated directly into DDL statements using f‑strings. This unparameterized identifier insertion allows an attacker who can influence monitoring statistics or trigger the export to inject arbitrary SQL. The vulnerability is classified as CVE‑2026‑32611 and is a classic SQL injection (CWE‑89) that can compromise data integrity and confidentiality by allowing malicious DDL operations.
Affected Systems
The affected product is Glances from the vendor 'nicolargo' (CPE: cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*).* All releases prior to version 4.5.3 are vulnerable, including the 4.5.2 release referenced in the advisory. The vulnerability exists in the DuckDB export module located at glances/exports/glances_duckdb/__init__.py.
Risk and Exploitability
The CVSS score is 7, indicating high severity. The EPSS score is reported as less than 1%, suggesting that exploitation is relatively uncommon. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Attackers would need local or otherwise privileged access to execute the vulnerable export function; however, the unparameterized DDL lets an attacker potentially write arbitrary tables or drop data. The lack of a public exploit does not negate the risk, and the severity rating recommends remediation.
Github GHSA