CVE-2026-53925

Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command. When Application Monitoring Process (AMP) modules load their command or service_cmd configuration values from glances.conf, those values are passed directly to secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via >), chain arbitrary commands (via &&), or pipe command output to arbitrary programs (via |). This vulnerability is fixed in 4.5.5.

• CWE-22

• https://github.com/nicolargo/glances/security/advisories/GHSA-3vwc-qwhc-3mj7
• https://github.com/nicolargo/glances/security/advisories/GHSA-3vwc-qwhc-3mj7

Published

Jun 25, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53914In JetBrains Kotlin before 2.4.20 code execution was possibl…9.8
• CVE-2026-53915In JetBrains GoLand before 2026.1.3 remote code execution wa…8.8
• CVE-2026-53916Memory Allocation with Excessive Size Value vulnerability in…7.5
• CVE-2026-53917Memory Allocation with Excessive Size Value vulnerability in…7.5
• CVE-2026-5392Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 me…5.4
• CVE-2026-53923vLLM is an inference and serving engine for large language m…7.5
• CVE-2026-53926NocoDB is software for building databases as spreadsheets. P…6.3
• CVE-2026-53927NocoDB is software for building databases as spreadsheets. P…5.1
• CVE-2026-53928NocoDB is software for building databases as spreadsheets. P…6.3
• CVE-2026-53929NocoDB is software for building databases as spreadsheets. P…5.1
• CVE-2026-5393Dual-Algorithm CertificateVerify out-of-bounds read. When pr…9.1
• CVE-2026-53930NocoDB is software for building databases as spreadsheets. P…5.1