What is CVE-2026-62982?
Glances versions 4.5.2 to 4.5.6 fail to sanitize nested lists and dictionaries in `_sanitize_mustache_dict()`, allowing pipe characters from process `cmdline` values to survive `chevron.render()` and be executed via `secure_popen()`. This enables command injection, and users should immediately upgrade to a patched version.
Azərbaycanca: Glances monitorinq alətində 4.5.2-dən 4.5.6-ya qədər versiyalarda nested siyahılar və lüğətlər sanitizasiya olunmadığından, `pipe` simvolu ilə əmr inyeksiyası mümkündür. Zərərli `cmdline` dəyərləri təhlükəsiz popen çağırışlarında icra oluna bilər. İstifadəçilərə təcili olaraq yeni versiyaya yeniləmə tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-77
FAQ2
Which versions of the Glances monitoring tool are affected by CVE-2026-62982?
The vulnerability affects Glances versions 4.5.2 to 4.5.6.
What mechanism in Glances allows command injection via CVE-2026-62982?
The vulnerability arises because `_sanitize_mustache_dict()` fails to sanitize nested lists and dictionaries, allowing pipe characters from process `cmdline` values to survive `chevron.render()` and be executed via `secure_popen()` calls.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.