Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

SummaryCVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates.The sanitizer only processes top-level stri...

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

EUVD-2026-60303

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-32608

A flaw was found in glances. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables e.g., 'name', 'key' that are populated with runtime monitoring data. The 'securepopen'...

DEBIAN-CVE-2026-32608

Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables e.g., name, key that are populated with runtime...

CVE-2026-32608

Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables e.g., name, key that are populated with runtime...

CVE-2026-32608

creationtimestamp| type| source ---|---|--- 2026-03-14 14:52:54+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-vcv2-q258-wrg7 2026-03-18 09:46:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhd7en3acd2n 2026-03-18...

CVE-2021-32608

An issue was discovered in Smartstore aka SmartStoreNET through 4.1.1. Views/Boards/Partials/ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum post...

CVE-2025-32608

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Movylo Movylo Marketing Automation movylo-widget allows Reflected XSS.This issue affects Movylo Marketing Automation: from n/a through = 2.0.7...

CVE-2025-32608 WordPress Movylo Marketing Automation Plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Movylo Movylo Marketing Automation allows Reflected XSS. This issue affects Movylo Marketing Automation: from n/a through 2.0.7...

CVE-2025-32608 WordPress Movylo Marketing Automation Plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Movylo Movylo Marketing Automation movylo-widget allows Reflected XSS.This issue affects Movylo Marketing Automation: from n/a through = 2.0.7...

CVE-2025-32608

CVE-2025-32608 describes a reflected Cross-Site Scripting (XSS) in Movylo Marketing Automation up to version 2.0.7, caused by improper neutralization of input during web page generation. Public records (NVD, Red Hat, CVE List, PatchStack) confirm the affected product and version range, and that e...

Linux Distros Unpatched Vulnerability : CVE-2024-32608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 library through 1.14.3 has memory corruption in H5Aclose resulting in the corruption of the instruction pointer and causing denial of service or potential...

CVE-2024-32608

creationtimestamp| type| source ---|---|--- 2024-10-09 08:07:10+00:00| seen| https://t.me/cvedetector/7425...

CVE-2024-32608

HDF5 library through 1.14.3 has memory corruption in H5Aclose resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...

CVE-2024-32608

HDF5 library through 1.14.3 has memory corruption in H5Aclose resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...

CVE-2024-32608

HDF5 library through 1.14.3 has memory corruption in H5Aclose resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...

CVE-2024-32608

HDF5 library through 1.14.3 has memory corruption in H5Aclose resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...