CVE-2026-33641

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.

• CWE-78

• https://github.com/nicolargo/glances/commit/358d76a225fc21a9f95d2c4d7e46fafe64a644c6Patch
• https://github.com/nicolargo/glances/releases/tag/v4.5.3Product, Release Notes
• https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7Exploit, Vendor Advisory
• https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7Exploit, Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33634Trivy is a security scanner. On March 19, 2026, a threat act…8.8
• CVE-2026-33635iCalendar is a Ruby library for dealing with iCalendar files…4.3
• CVE-2026-33636LIBPNG is a reference library for use in applications that r…7.6
• CVE-2026-33637Faraday is an HTTP client library abstraction layer that pro…6.5
• CVE-2026-33638Ech0 is an open-source, self-hosted publishing platform for …5.3
• CVE-2026-33640Outline is a service that allows for collaborative documenta…9.8
• CVE-2026-33642Kitty is a cross-platform GPU based terminal. In versions 0.…9.8
• CVE-2026-33643SQL Injection vulnerability in SchemaHero 0.23.0 via the col…7.4
• CVE-2026-33644Lychee is a free, open-source photo-management tool. Prior t…4.3
• CVE-2026-33645Fireshare facilitates self-hosted media and link sharing. In…8.1
• CVE-2026-33646mise manages dev tools like node, python, cmake, and terrafo…9.6
• CVE-2026-33647WWBN AVideo is an open source video platform. In versions up…8.8