{"id":"CVE-2026-68519","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-68519","summary":"Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)","details":"## Summary\nIn Glances 4.5.5 the `--disable-config-exec` flag was extended (GHSA-3vwc-qwhc-3mj7) to stop `secure_popen()` from\ninterpreting the shell operators `&&`, `|` and `>` in **AMP** command values taken from the configuration file. The\nhardening was not applied to the **on-alert action** command path, which reads its command lines from the same\nconfiguration file. As a result, with `--disable-config-exec` enabled, a configured alert action that contains `>`\n(file redirection), `&&` (chaining) or `|` (pipe) still has those operators interpreted, allowing arbitrary file\nwrite / command chaining at the privilege of the glances process when the alert triggers.\n\n## Affected code\n`glances/actions.py` (Glances 4.5.5, latest):\n```python\nret = secure_popen(cmd_full)        # line 111 — no allow_operators=, defaults to True\n```\nBy contrast the AMP modules were fixed:\n```python\n# glances/amps/default/__init__.py:69\nself.set_result(secure_popen(res, allow_operators=self.allow_operators()).rstrip())\n# glances/amps/systemv/__init__.py:60\nres = secure_popen(self.get('service_cmd'), allow_operators=self.allow_operators())\n```\n\n## PoC (benign)\n`glances.conf`:\n```ini\n[cpu]\nuser_critical=1\nuser_critical_action=echo MARKER > /tmp/poc_marker\n```\nRun `glances --disable-config-exec` and generate CPU load. When the cpu `user` alert reaches CRITICAL, `/tmp/poc_marker`\nis created — i.e. the `>` operator was interpreted despite `--disable-config-exec`. The same `>` in an `[amp_*]`\n`command` value is correctly *not* interpreted.\n\n## Impact\nArbitrary file write (`>`), command chaining (`&&`) and pipe (`|`) from config-defined alert actions, contrary to the\nguarantee of `--disable-config-exec`. Trust boundary = the glances configuration file.\n\n## Suggested fix\nPass `allow_operators=not args.disable_config_exec` from `GlancesActions.run()` into `secure_popen()` (GlancesActions\nalready holds `args`).\n\n## Credit\nReported via responsible-disclosure incomplete-fix measurement study.","published":"2026-08-17T17:20:37Z","modified":"2026-08-17T17:30:07.206973742Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"glances","fixedVersion":"4.5.6"}],"fix":{"url":"https://github.com/nicolargo/glances/commit/5c07c0d96423e9d5b9de71dd92e3717c66f504bd","label":"nicolargo/glances@5c07c0d"},"references":[{"type":"WEB","url":"https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh"},{"type":"WEB","url":"https://github.com/nicolargo/glances/commit/5c07c0d96423e9d5b9de71dd92e3717c66f504bd"},{"type":"PACKAGE","url":"https://github.com/nicolargo/glances"},{"type":"WEB","url":"https://github.com/nicolargo/glances/releases/tag/v4.5.6"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-17T17:30:07.206973742Z"}}