# Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances' CVE-2026-32608 sanitizer only strips shell operators from top-level strings, so a pipe in the nested process cmdline list reaches secure_popen and executes commands as root.

- Payout: Research
- Severity: high
- Program: Glances
- Found by: thientd
- Disclosed: 2026-08-17
- CVE: CVE-2026-62982
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-73wf-9vmv-5pv9
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-73wf-9vmv-5pv9
- Tags: area:cloud domain:infra impact:privesc impact:rce kind:research platform:ghsa sev:high tech:python technique:incomplete-fix technique:source-review vuln:command-injection vuln:rce

**Target:** Glances action command templates rendered via chevron into secure_popen
**Root cause:** _sanitize_mustache_dict only strips shell operators from top-level str values; nested list/dict values (process cmdline) pass verbatim, and chevron does not HTML-escape '|', so the pipe survives into secure_popen which interprets operators by default.
**Steps:**
1. Configure an alert action template rendering a nested field, e.g. `echo ALERT {{#cmdline}}{{.}} {{/cmdline}}`.
2. Launch a process with argv `['x', '|touch /tmp/glances_poc_marker', '#']` so its cmdline list contains a pipe.
3. Trigger the action; `_sanitize_mustache_dict` skips the list, chevron renders `echo ALERT x |touch /tmp/glances_poc_marker # `.
4. `secure_popen` (allow_operators=True) interprets the pipe and runs the injected command in the Glances context.
**How found:** Reviewed the parent fix commit 5680a5d and noticed the sanitizer's isinstance(v, str) guard only handles top-level strings, leaving the else branch passing lists/dicts verbatim; then checked that chevron escapes & < > " ' but not '|', and that secure_popen defaults to allow_operators=True, making the nested cmdline list a viable injection vector.
**Exploitation:** Local unprivileged user sets a malicious argv on a process; when the admin-configured action template renders the process cmdline section, the unsanitized pipe splits the command in secure_popen and launches an attacker-chosen second process, typically as root in server/agent deployments.
**Escalation:** Privilege boundary crossed: unprivileged local user to command execution in the Glances (commonly root) security context.
**Insight:** When auditing a sanitizer fix, check the type guard: recursive structures (lists/dicts) often skip filtering. Also verify which characters the templating engine actually escapes — Mustache escapes HTML metacharacters but not shell pipes, so '|' survives into shell-ish sinks.

## Proof of concept (copied exactly from the original report)

**Attacker argv and action template for nested cmdline injection**

```
Attacker process argv (the only attacker input): `cmdline = ['x', '|touch /tmp/glances_poc_marker', '#']`.
Admin action template (renders the offending process's cmdline): `echo ALERT {{#cmdline}}{{.}} {{/cmdline}}`.
```