An OS command injection vulnerability in Glances enables local authenticated attackers to achieve full system compromise with elevated privileges.

This vulnerability is an OS Command Injection flaw (CWE-78) that occurs due to the failure to properly sanitize input. It requires an authenticated local user to trigger the injection, which then executes commands with the privileges of the Glances process.

The impact of a command injection is critical, potentially leading to a complete takeover of the underlying server. Given the CVSS score of 8.8, this flaw poses a severe threat to system integrity and confidentiality, as an attacker could execute arbitrary code to install backdoors, steal data, or disrupt monitoring services.

Immediate Action: Update the PyPI package for Glances to version 4.5.6 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Monitor system process logs for unauthorized or suspicious command executions originating from the Glances application.

Compensating Controls: Ensure that the Glances service is running with the least privilege necessary, and utilize containerization or sandboxing to limit the impact of potential command execution.

Public Exploit Available: No confirmed public exploit available.

Organizations should treat this command injection vulnerability with high urgency. Patching to version 4.5.6 is the most effective way to remediate the risk, and users should ensure their systems are hardened against potential local exploitation.