{"id":"CVE-2026-68519","title":"Glances is an open-source system cross-platform monitoring tool","summary":"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enable…","severity":"high","cwe":["CWE-78"],"vendor":"glances","product":"glances","affected":["glances <= 4.5.5"],"patched":["glances 4.5.6"],"published":"2026-08-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68519","references":[{"url":"https://github.com/nicolargo/glances/commit/5c07c0d96423e9d5b9de71dd92e3717c66f504bd","label":"security-advisories@github.com"},{"url":"https://github.com/nicolargo/glances/releases/tag/v4.5.6","label":"security-advisories@github.com"},{"url":"https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh","label":"security-advisories@github.com"},{"url":"https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-59fj-m2j6-hcxh"}],"tags":["nvd","ghsa","pip"],"epss":0.00178,"epssPercentile":0.07572,"aliases":["GHSA-59fj-m2j6-hcxh"],"ecosystem":"pip","ingestedAt":"2026-08-17T17:58:10.993Z","slug":"CVE-2026-68519","body":"## Overview\n\nGlances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-68519)\n\nAffected packages:\n\n- `glances <= 4.5.5`\n\nPatched in:\n\n- `glances 4.5.6`\n\nSource: https://github.com/advisories/GHSA-59fj-m2j6-hcxh","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}