Glances, an open‑source cross‑platform monitoring tool, has a command injection flaw in its KVM/QEMU engine; the engine interpolates VM domain names directly into shell command templates without sanitization, allowing any user who can create or rename a virtual machine to execute arbitrary commands as the OS user running Glances, typically root on hypervisor hosts. This vulnerability is classified as CWE‑78 – Improper Neutralization of Input During Command Construction.

Vendors affected are those running Glances version 4.5.4 and earlier, notably the nicolargo:glances product. The flaw is present in all systems prior to the 4.5.5 release, which contains the patch that sanitizes or otherwise protects the command construction process.

The issue carries a CVSS score of 7.8, indicating quite a high severity. Though no EPSS score is available, the lack of KEV listing suggests no widespread exploitation has been reported, yet the vulnerability remains easily exploitable in environments where users can create or rename VM domain names; the exploitation requires local privileges on the host but results in code execution as the Glances user, which is often root, making it high impact.