Cyber Posture

CVE-2026-33641

HighPublic PoC

Published: 02 April 2026

Published
02 April 2026
Modified
07 April 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 6.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33641 is a high-severity OS Command Injection (CWE-78) vulnerability in Nicolargo Glances. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-5 (Access Restrictions for Change) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the vulnerability by requiring timely patching of Glances to version 4.0.5.3, eliminating the command injection flaw.

prevent

Requires validation of configuration file inputs during parsing to prevent execution of arbitrary commands embedded in backticks.

prevent

Restricts access to Glances configuration files, preventing low-privilege attackers from injecting malicious dynamic values.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

OS command injection via backticks in config parsing directly enables arbitrary Unix shell command execution (T1059.004) upon process start/reload; when Glances runs with elevated privileges (e.g., as service), this facilitates local privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without…

more

validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.

Deeper analysisAI

CVE-2026-33641 is an OS command injection vulnerability (CWE-78) in Glances, an open-source cross-platform system monitoring tool. In versions prior to 4.5.3, the Config.get_value() function processes dynamic configuration values by executing substrings enclosed in backticks as system commands without any validation or restrictions during configuration parsing.

A local attacker with low privileges (PR:L) who can modify or influence Glances configuration files can exploit this issue to execute arbitrary commands automatically with the privileges of the Glances process upon startup or configuration reload. If Glances is deployed with elevated privileges, such as running as a system service, successful exploitation enables privilege escalation, potentially granting high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U).

The vulnerability has been patched in Glances version 4.5.3. Security practitioners should upgrade to this version for mitigation. Official resources include the GitHub security advisory at GHSA-qhj7-v7h7-q4c7, the patching commit 358d76a225fc21a9f95d2c4d7e46fafe64a644c6, and the release notes for v4.5.3.

Details

CWE(s)

Affected Products

nicolargo
glances
≤ 4.5.3

CVEs Like This One

CVE-2026-32596Same product: Nicolargo Glances
CVE-2026-32610Same product: Nicolargo Glances
CVE-2026-32634Same product: Nicolargo Glances
CVE-2026-30930Same product: Nicolargo Glances
CVE-2026-35587Same product: Nicolargo Glances
CVE-2026-32611Same product: Nicolargo Glances
CVE-2026-30928Same product: Nicolargo Glances
CVE-2026-32633Same product: Nicolargo Glances
CVE-2026-32609Same product: Nicolargo Glances
CVE-2026-5208Shared CWE-78

References