Glances, a cross-platform system monitoring tool, contains an OS command injection vulnerability identified as CVE-2026-68519 (CWE-78). In versions before 4.5.6, the function GlancesActions.run() in glances/actions.py does not respect the --disable-config-exec flag for on-alert action commands. It calls secure_popen() with shell operators enabled, which allows an attacker to execute arbitrary shell commands via configured alert actions that include shell operators such as redirection, command chaining, or pipes. This vulnerability is resolved in Glances version 4.5.6.

An attacker with the ability to configure alert actions in Glances prior to version 4.5.6 can execute arbitrary OS commands with the privileges of the Glances process. This can lead to unauthorized command execution, potentially compromising the system's integrity and confidentiality. The vulnerability requires local access (AV:L) and privileges (PR:H) but does not require user interaction (UI:N).

Upgrade Glances to version 4.5.6 or later, where this vulnerability is fixed. There is no official patch advisory provided, but the fix is included in the 4.5.6 release. Until upgrading, avoid configuring alert actions that include shell operators or disable alert actions if possible.