by Kastro
Paper/Archive/CVE-2026-30930

CVE-2026-30930

nicolargo glances — Glances has SQL Injection via Process Names in TimescaleDB Export

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 31.8.318 × 206.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1.

Affected

ProductAffectedFixed inSource
glances< 4.5.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)7.3CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6refgithub.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336refgithub.com/nicolargo/glances/releases/tag/v4.5.1