{"id":"CVE-2026-68518","title":"Glances is an open-source system cross-platform monitoring tool","summary":"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables…","severity":"high","cwe":["CWE-78"],"vendor":"glances","product":"glances","affected":["glances <= 4.5.5"],"patched":["glances 4.5.6"],"published":"2026-08-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68518","references":[{"url":"https://github.com/nicolargo/glances/commit/9c280eae5419da680827024b60f6265956e31994","label":"security-advisories@github.com"},{"url":"https://github.com/nicolargo/glances/releases/tag/v4.5.6","label":"security-advisories@github.com"},{"url":"https://github.com/nicolargo/glances/security/advisories/GHSA-qcpp-8x79-hhp3","label":"security-advisories@github.com"},{"url":"https://github.com/nicolargo/glances/security/advisories/GHSA-qcpp-8x79-hhp3","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-qcpp-8x79-hhp3"}],"tags":["nvd","ghsa","pip"],"epss":0.00192,"epssPercentile":0.09139,"aliases":["GHSA-qcpp-8x79-hhp3"],"ecosystem":"pip","ingestedAt":"2026-08-17T16:57:25.330Z","slug":"CVE-2026-68518","body":"## Overview\n\nGlances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure_popen() executes when attacker-controlled process or container fields are rendered by an administrator-configured action template. This issue is fixed in 4.5.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-68518)\n\nAffected packages:\n\n- `glances <= 4.5.5`\n\nPatched in:\n\n- `glances 4.5.6`\n\nSource: https://github.com/advisories/GHSA-qcpp-8x79-hhp3","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}