Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports
    dynamic configuration values in which substrings enclosed in backticks are executed as system commands
    during configuration parsing. This behavior occurs in Config.get_value() and is implemented without
    validation or restriction of the executed commands. If an attacker can modify or influence configuration
    files, arbitrary commands will execute automatically with the privileges of the Glances process during
    startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a
    system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.
    (CVE-2026-33641)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports     dynamic configuration values in which substrings enclosed in backticks are executed as system commands     during configuration parsing. This behavior occurs in Config.get_value() and is implemented without     validation or restriction of the executed commands. If an attacker can modify or influence configuration     files, arbitrary commands will execute automatically with the privileges of the Glances process during     startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a     system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.
    (CVE-2026-33641)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
440913	SCA: security update for Glances (GHSA-qhj7-v7h7-q4c7)	Tenable Cloud Security	SCA Checks	high
440913	SCA: security update for Glances (GHSA-qhj7-v7h7-q4c7)	Tenable Self-Hosted Container Security	SCA Checks	high
304886	Linux Distros Unpatched Vulnerability : CVE-2026-33641	Nessus	Misc.	high

Detections

Analytics

CVE-2026-33641

high

Tenable Plugins

high

high

high