CVE-2026-46607
Reported by github_m · Published June 25, 2026
glances is fixed in 4.5.5 (PyPI)
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path — through any of several realistic local or container-level scenarios — can plant a malicious pickle file and achieve arbitrary code execution as the OS user running Glances the next time it starts with version checking enabled (the default). This vulnerability is fixed in 4.5.5.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| glances | PyPI | 4.5.5 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| nicolargo | glances | < 4.5.5 |
| nicolargo | glances | 0 |
| PyPI | Glances | 0 |
Timeline
- Jun 22, 2026 CVE Published
- Jun 25, 2026 CVE Updated
- Jun 26, 2026 Coalition ESS Score
- Jun 26, 2026 Security Advisory
- Aug 7, 2026 EPSS Score (25 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-46607
vulnetix vdb fixes CVE-2026-46607Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-46607/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/nicolargo/glances/security/advisories/GHSA-9837-48hr-q32j x_refsource_CONFIRM
- https://github.com/nicolargo/glances/releases/tag/v4.5.5 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-46607 advisory
- https://github.com/advisories/GHSA-9837-48hr-q32j advisory
- https://github.com/nicolargo/glances url
- https://github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2026-2496.yaml advisory
- https://pypi.org/project/glances url