Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-30930

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f8c4f0ce58240b7edacdffb5d1ad4e4808617dd35d09f3d42cfaa29b8e5bfbfc
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"glances","vendor":"nicolargo","versions":[{"status":"affected","version":"< 4.5.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:8d7644497b15346a09099073fa8fb4a14212cfd5252975bbf7de6232cb0a9a9b · sha256:35cb5145aac18198… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":7.3,"baseSeverity":"HIGH","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:8d7644497b15346a09099073fa8fb4a14212cfd5252975bbf7de6232cb0a9a9b · sha256:35cb5145aac18198… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-89","description":"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:8d7644497b15346a09099073fa8fb4a14212cfd5252975bbf7de6232cb0a9a9b · sha256:35cb5145aac18198… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336","tags":["x_refsource_MISC"],"url":"https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:8d7644497b15346a09099073fa8fb4a14212cfd5252975bbf7de6232cb0a9a9b · sha256:35cb5145aac18198… · /containers/cna/references/1
{"name":"https://github.com/nicolargo/glances/releases/tag/v4.5.1","tags":["x_refsource_MISC"],"url":"https://github.com/nicolargo/glances/releases/tag/v4.5.1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:8d7644497b15346a09099073fa8fb4a14212cfd5252975bbf7de6232cb0a9a9b · sha256:35cb5145aac18198… · /containers/cna/references/2
{"name":"https://github.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6","tags":["x_refsource_CONFIRM"],"url":"https://github.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:8d7644497b15346a09099073fa8fb4a14212cfd5252975bbf7de6232cb0a9a9b · sha256:35cb5145aac18198… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer