An OS command injection vulnerability in the Glances monitoring tool allows local attackers to execute arbitrary system commands, posing a risk of full system compromise.

The vulnerability exists within the secure_popen function, which fails to properly sanitize Mustache template variables before execution. An attacker with local access who can influence monitored data, such as process or container names, can inject shell metacharacters to trigger command execution.

The flaw carries a CVSS score of 7.0, indicating high severity. Successful exploitation allows a local attacker to achieve code execution with the privileges of the Glances process, potentially leading to unauthorized data access, system disruption, or privilege escalation. This risk is particularly significant in environments where Glances is deployed to monitor containers or processes managed by lower-privileged users.

Immediate Action: Update the Glances package to version 4.5.2 or later immediately to incorporate the necessary command sanitization logic.

Proactive Monitoring: Audit system logs for unusual shell process spawns or unexpected command-line arguments originating from the Glances service.

Compensating Controls: Restrict local access to the system to authorized users only, and ensure that the Glances service is running with the minimum necessary privileges to reduce the impact of potential exploitation.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete system compromise, administrators should prioritize the update to Glances 4.5.2 across all affected environments. While the attack vector is local, the severity of command injection necessitates prompt remediation to prevent malicious actors from leveraging this flaw to gain unauthorized control over monitoring infrastructure.