7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46606

CVE-2026-46606: Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46606

CVE-2026-46606:

7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
glances	pip	< 4.5.5	4.5.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic command injection located in the KVM/QEMU monitoring engine of Glances. The root cause was the unsafe construction of shell commands using f-strings, where unsanitized virtual machine domain names were directly embedded into the command. These commands were then processed by a secure_popen function that explicitly interprets shell operators like &&, |, and >. The analysis of the patch commit e1f6c387dd9cdb378c950afa0889d6a5ec6b7bb7 confirms this. The patch replaces the insecure secure_popen calls within the VmExtension.update_stats and VmExtension.update_title functions with a new _run_virsh helper function. This new function utilizes subprocess.run with a list of arguments, which correctly treats the VM domain name as a single, non-executable argument, thereby preventing any shell operator interpretation and mitigating the command injection risk. Any user with privileges to create or rename a VM could have exploited this to gain arbitrary code execution, likely as the root user, on the hypervisor.

Vulnerable functions

VmExtension.update_stats

glances/plugins/vms/engines/virsh.py

This function was vulnerable to command injection because it used an f-string to build a command that was passed to `secure_popen`. The `domain` variable, an unsanitized VM domain name, was directly concatenated into the command string. An attacker could create a VM with a specially crafted name containing shell metacharacters (e.g., '&&', '|', '>') to execute arbitrary commands on the host system.

VmExtension.update_title

glances/plugins/vms/engines/virsh.py

This function was vulnerable to command injection for the same reason as `update_stats`. It constructed a command using an f-string with the unsanitized `domain` variable and executed it via `secure_popen`. This allowed attackers to inject commands by creating a VM with a malicious name.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.