🚨 HIGH - Glances AMP config command injection via secure_popen operator parsing (CVE-2026-53925) Glances is vulnerable in its secure_popen() implementation, which is used to run AMP module command/service_cmd entries from glances.conf and wrongly treats shell-like operators (>, |, &&) as meaningful input. The root cause is improper input validation leading to command injection and arbitrary file write via redirection/piping semantics being interpreted from untrusted strings. An attacker who can modify glances.conf AMP module command/service_cmd values can exploit this by injecting operator chains to redirect output to attacker-chosen paths or pipe/chains to execute additional commands, and --disable-config-exec does not prevent this because it only blocks backticks during parsing. If exploited, this can result in arbitrary command execution and arbitrary file writes, enabling privilege escalation, persistence, data tampering, or full host compromise depending on the Glances runtime privileges. 👉 Affected: glances (versions not specified) | Upgrade to No fix yet treat as suspicious
Post summary
The advisory details a command injection flaw in Glances’s secure_popen handler, enabling arbitrary command and file write operations, but does not provide a PoC, exploit code, patch, or evidence of active exploitation.