Glances, a cross‑platform monitoring tool, uses a Mustache‑based templating system for administrator‑configured action templates. In versions prior to 4.5.6 an individual variable sanitizer in _sanitize_mustache_dict() does not prevent adjacent unescaped Mustache variables from being concatenated into shell operators that secure_popen() will interpret. As a result, an attacker who can influence the process or container fields in a template can inject arbitrary shell commands that will be executed with the privileges of the Glances process, leading to remote code execution on the host.

The vulnerability affects the Glances package from the vendor nicolargo. Any installation using version 4.5.5 or earlier is impacted; the issue was resolved in version 4.5.6.

The CVSS score is 8.8, indicating a high severity. EPSS is not available, and KEV has not listed this issue, so the measured likelihood of exploitation is unknown. Based on the description, exploitation requires the ability to modify the administrator‑defined action template or supply attacker‑controlled process/ container values. If an attacker gains that level of access, they can trigger arbitrary shell command execution. The vulnerability is not yet catalogued in CISA KEV, but the high CVSS indicates significant risk for affected installations if the templates remain editable.