CVE-2026-33641 Glances Vulnerable to Command Injection via Dynamic Configuration Values
Attackers with configuration file access can execute arbitrary commands via backtick syntax, potentially escalating privileges in elevated deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33641?
CVE-2026-33641 is a high-severity command injection vulnerability in nicolargo glances, published on 2 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.
Weakness: CWE-78
Which versions are affected by CVE-2026-33641?
3 open source packages ship an affected version, including glances and Glances. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
glances PyPI | All versions | 4.5.3 |
glances PyPI | All versions | 4.5.3 |
Glances PyPI | All versions | 4.5.3 |
Products include Nicolargo Glances.
How do I fix CVE-2026-33641?
Upgrade glances to 4.5.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-33641 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33641 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in nicolargo glances
- CVE-2026-32633 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
- CVE-2026-32596 Glances exposes the REST API without authentication
- CVE-2026-30928 Glances Exposes Unauthenticated Configuration Secrets
- CVE-2026-32610 Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
- CVE-2026-32634 Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
Sources
Also known as DEBIAN-CVE-2026-33641, GHSA-qhj7-v7h7-q4c7, PYSEC-2026-2174, UBUNTU-CVE-2026-33641.