# Glances has SQL Injection via Process Names in TimescaleDB Export

Glances TimescaleDB exporter concatenates unsanitized process names into INSERT SQL, letting any local user inject SQL via a crafted process name.

- Payout: Research
- Severity: high
- Program: Glances
- Found by: theamanrawat, neo-ai-engineer
- Disclosed: 2026-03-09
- CVE: CVE-2026-30930
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-x46r-mf5g-xpr6
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-x46r-mf5g-xpr6
- Tags: area:cloud domain:infra impact:data-leak impact:privesc impact:rce kind:research platform:ghsa sev:high tech:python technique:source-review vuln:sqli

**Target:** TimescaleDB export module (glances_timescaledb) normalize() and INSERT query construction
**Root cause:** normalize() wraps string values in single quotes via f"'{value}'" without escaping embedded quotes, and the resulting fragments are concatenated into INSERT statements executed directly with cur.execute() instead of parameterized queries.
**Steps:**
1. Create a process whose name carries the payload: `exec -a "x'); COPY (SELECT version()) TO '/tmp/sqli_proof.txt' --" python3 -c '...'`
2. Run Glances with TimescaleDB export as root: `glances --export timescaledb --export-process-filter ".*" --time 5 --stdout cpu`
3. Observe `/tmp/sqli_proof.txt` created, proving injected SQL executed
**How found:** Code review of the export module: noticed normalize() only wraps strings in quotes without escaping, and that the fragments feed directly into string-formatted INSERT queries executed via cur.execute().
**Exploitation:** Any local user spawns a process with a crafted name; when Glances exports process data to TimescaleDB, the name is embedded unescaped into the INSERT and executed, allowing arbitrary SQL such as COPY ... TO for exfiltration or COPY ... PROGRAM for OS command execution under the DB connection's privileges.
**Escalation:** Injected SQL runs against the PostgreSQL/TimescaleDB instance, enabling data destruction, exfiltration of other tables, and potential RCE via COPY ... PROGRAM or extensions.
**Insight:** Monitoring/export agents that serialize host-controlled strings (process names, mount points, interface names) into SQL are a reliable injection surface — grep exporters for f-string query building and test with a process name containing a single quote.

## Proof of concept (copied exactly from the original report)

**Process name carrying SQL injection payload**

```
exec -a "x'); COPY (SELECT version()) TO '/tmp/sqli_proof.txt' --"   python3 -c 'import time; [sum(range(500000)) or time.sleep(0.01) for _ in iter(int, 1)]'
```

**Glances command triggering TimescaleDB export**

```
glances --export timescaledb --export-process-filter ".*" --time 5 --stdout cpu
```