CVE-2026-68519: Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
In Glances 4.5.5 the --disable-config-exec flag was extended (GHSA-3vwc-qwhc-3mj7) to stop secure_popen() from
interpreting the shell operators &&, | and > in AMP command values taken from the configuration file. The
hardening was not applied to the on-alert action command path, which reads its command lines from the same
configuration file. As a result, with --disable-config-exec enabled, a configured alert action that contains >
(file redirection), && (chaining) or | (pipe) still has those operators interpreted, allowing arbitrary file
write / command chaining at the privilege of the glances process when the alert triggers.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-68519 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →