An OS command injection vulnerability in Glances permits authenticated local users to execute arbitrary commands, potentially resulting in full system compromise.

This is an OS command injection vulnerability (CWE-78) where the application fails to neutralize special elements in user-supplied input. An authenticated local attacker can leverage this flaw to run malicious commands on the host operating system.

The ability to inject and execute arbitrary OS commands provides an attacker with complete control over the affected system. With a CVSS score of 8.8, this vulnerability presents a significant risk of total system compromise, including the ability to bypass security controls, access sensitive internal data, and maintain persistent access.

Immediate Action: Update Glances to version 4.5.6, which contains the security patches required to neutralize the command injection vector.

Proactive Monitoring: Review system logs for unusual process spawning or unexpected command-line arguments associated with the Glances service.

Compensating Controls: Restrict local user access to the system and ensure that the Glances service runs with limited permissions to minimize the potential impact of command execution.

Public Exploit Available: No confirmed public exploit available.

The risk posed by this command injection vulnerability is significant due to the potential for total system compromise. IT teams must prioritize updating to version 4.5.6 immediately to eliminate the underlying flaw and secure their monitoring infrastructure.