What’s Vulnerable › Vulnerabilities

CVE-2026-30930: Glances has SQL Injection via Process Names in TimescaleDB Export

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-10 · updated 2026-06-17
• Weakness: CWE-89

Description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1.

Affected products

• nicolargo glances: before 4.5.1 — fixed in 4.5.1

How to fix

Upgrade to a fixed version: nicolargo glances 4.5.1. Check the vendor advisory for mitigations.

References

• https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336
• https://github.com/nicolargo/glances/releases/tag/v4.5.1
• https://github.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6

Get alerted when CVE-2026-30930 or the next vulnerability affects your stack