CVE-2026-46606: Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
(updated )
The Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts.
References
- github.com/advisories/GHSA-v5r2-qh84-fjx5
- github.com/nicolargo/glances
- github.com/nicolargo/glances/releases/tag/v4.5.5
- github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5
- github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2026-2497.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-46606
- pypi.org/project/glances
Code Behaviors & Features
Detect and mitigate CVE-2026-46606 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →