CVE-2026-68519: Glances `--disable-config-exec` Does Not Cover On-alert Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-59fj-m2j6-hcxh",
  "modified" : "2026-08-17T17:20:37Z",
  "published" : "2026-08-17T17:20:37Z",
  "aliases" : [ "CVE-2026-68519" ],
  "summary" : "Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)",
  "details" : "## Summary\nIn Glances 4.5.5 the `--disable-config-exec` flag was extended (GHSA-3vwc-qwhc-3mj7) to stop `secure_popen()` from\ninterpreting the shell operators `&&`, `|` and `>` in **AMP** command values taken from the configuration file. The\nhardening was not applied to the **on-alert action** command path, which reads its command lines from the same\nconfiguration file. As a result, with `--disable-config-exec` enabled, a configured alert action that contains `>`\n(file redirection), `&&` (chaining) or `|` (pipe) still has those operators interpreted, allowing arbitrary file\nwrite / command chaining at the privilege of the glances process when the alert triggers.\n\n## Affected code\n`glances/actions.py` (Glances 4.5.5, latest):\n```python\nret = secure_popen(cmd_full)        # line 111 — no allow_operators=, defaults to True\n```\nBy contrast the AMP modules were fixed:\n```python\n# glances/amps/default/__init__.py:69\nself.set_result(secure_popen(res, allow_operators=self.allow_operators()).rstrip())\n# glances/amps/systemv/__init__.py:60\nres = secure_popen(self.get('service_cmd'), allow_operators=self.allow_operators())\n```\n\n## PoC (benign)\n`glances.conf`:\n```ini\n[cpu]\nuser_critical=1\nuser_critical_action=echo MARKER > /tmp/poc_marker\n```\nRun `glances --disable-config-exec` and generate CPU load. When the cpu `user` alert reaches CRITICAL, `/tmp/poc_marker`\nis created — i.e. the `>` operator was interpreted despite `--disable-config-exec`. The same `>` in an `[amp_*]`\n`command` value is correctly *not* interpreted.\n\n## Impact\nArbitrary file write (`>`), command chaining (`&&`) and pipe (`|`) from config-defined alert actions, contrary to the\nguarantee of `--disable-config-exec`. Trust boundary = the glances configuration file.\n\n## Suggested fix\nPass `allow_operators=not args.disable_config_exec` from `GlancesActions.run()` into `secure_popen()` (GlancesActions\nalready holds `args`).\n\n## Credit\nReported via responsible-disclosure incomplete-fix measurement study.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "glances"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.5.6"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.5.5"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nicolargo/glances/commit/5c07c0d96423e9d5b9de71dd92e3717c66f504bd"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nicolargo/glances"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nicolargo/glances/releases/tag/v4.5.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-78" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-17T17:20:37Z",
    "nvd_published_at" : null
  }
}