Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command. When Application Monitoring Process (AMP) modules load their command or service_cmd configuration values from glances.conf, those values are passed directly to secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via >), chain arbitrary commands (via &&), or pipe command output to arbitrary programs (via |). This vulnerability is fixed in 4.5.5.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the     secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command     chaining) operators in command strings. These operators are applied without any validation on the target     file path, piped command, or chained command. When Application Monitoring Process (AMP) modules load their     command or service_cmd configuration values from glances.conf, those values are passed directly to     secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file     to write arbitrary content to arbitrary filesystem paths (via >), chain arbitrary commands (via &&), or     pipe command output to arbitrary programs (via |). This vulnerability is fixed in 4.5.5. (CVE-2026-53925)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the
    secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command
    chaining) operators in command strings. These operators are applied without any validation on the target
    file path, piped command, or chained command. When Application Monitoring Process (AMP) modules load their
    command or service_cmd configuration values from glances.conf, those values are passed directly to
    secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file
    to write arbitrary content to arbitrary filesystem paths (via >), chain arbitrary commands (via &&), or
    pipe command output to arbitrary programs (via |). This vulnerability is fixed in 4.5.5. (CVE-2026-53925)

ID	Name	Product	Family	Severity
323801	Linux Distros Unpatched Vulnerability : CVE-2026-53925	Nessus	Misc.	high
443805	SCA: security update for glances (GHSA-3vwc-qwhc-3mj7)	Tenable Cloud Security	SCA Checks	high
443805	SCA: security update for glances (GHSA-3vwc-qwhc-3mj7)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-53925

high

Tenable Plugins

high

high

high