CVE-2026-68519: Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
In Glances 4.5.5 the --disable-config-exec flag was extended (GHSA-3vwc-qwhc-3mj7) to stop secure_popen() from
interpreting the shell operators &&, | and > in AMP command values taken from the configuration file. The
hardening was not applied to the on-alert action command path, which reads its command lines from the same
configuration file. As a result, with --disable-config-exec enabled, a configured alert action that contains >
(file redirection), && (chaining) or | (pipe) still has those operators interpreted, allowing arbitrary file
write / command chaining at the privilege of the glances process when the alert triggers.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-68519 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →