Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-32611

critical

CVE-2026-32611

Glances is an open-source system cross-platform monitoring tool. The G ...

Published Modified CWE 89
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA7.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high).

Description

Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.

Affected packages and fixed versions

SourcePackageFixed in
debian 12glancesno fix listed
debian 13glancesno fix listed
debian 14glances4.5.2+dfsg-1
echoglancesno fix listed
pip::GitHub Security Advisory pipglances4.5.2
rapidfort debian 12glances0:4.5.2+dfsg-1
rapidfort debian 13glances0:4.5.2+dfsg-1

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.