CVE-2026-30930

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30930", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T16:40:05.885Z", "datePublished": "2026-03-10T16:16:59.991Z", "dateUpdated": "2026-03-11T03:57:17.097Z"}, "containers": {"cna": {"title": "Glances has SQL Injection via Process Names in TimescaleDB Export", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6"}, {"name": "https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336", "tags": ["x_refsource_MISC"], "url": "https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336"}, {"name": "https://github.com/nicolargo/glances/releases/tag/v4.5.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.1"}], "affected": [{"vendor": "nicolargo", "product": "glances", "versions": [{"version": "< 4.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T16:16:59.991Z"}, "descriptions": [{"lang": "en", "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1."}], "source": {"advisory": "GHSA-x46r-mf5g-xpr6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-30930"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T03:57:17.097Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30930", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T16:40:20.789428Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T16:40:49.503Z"}}], "cna": {"title": "Glances has SQL Injection via Process Names in TimescaleDB Export", "source": {"advisory": "GHSA-x46r-mf5g-xpr6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nicolargo", "product": "glances", "versions": [{"status": "affected", "version": "< 4.5.1"}]}], "references": [{"url": "https://github.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6", "name": "https://github.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336", "name": "https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nicolargo/glances/releases/tag/v4.5.1", "name": "https://github.com/nicolargo/glances/releases/tag/v4.5.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T16:16:59.991Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30930", "state": "PUBLISHED", "dateUpdated": "2026-03-11T03:57:17.097Z", "dateReserved": "2026-03-07T16:40:05.885Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T16:16:59.991Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "glances", "vendor": "nicolargo", "versions": [{"status": "affected", "version": "< 4.5.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B30F860-5F24-4658-B6CD-B1507A8A3747", "versionEndExcluding": "4.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1."}, {"lang": "es", "value": "Glances es una herramienta de monitoreo de sistema de c\u00f3digo abierto multiplataforma. Antes de la versi\u00f3n 4.5.1, el m\u00f3dulo de exportaci\u00f3n de TimescaleDB construye consultas SQL utilizando concatenaci\u00f3n de cadenas con datos de monitoreo del sistema no saneados. El m\u00e9todo normalize() envuelve los valores de cadena entre comillas simples pero no escapa las comillas simples incrustadas, lo que hace que la inyecci\u00f3n SQL sea trivial a trav\u00e9s de datos controlados por el atacante, como nombres de procesos, puntos de montaje del sistema de archivos, nombres de interfaces de red o nombres de contenedores. Esta vulnerabilidad se corrige en la versi\u00f3n 4.5.1."}], "id": "CVE-2026-30930", "lastModified": "2026-06-17T10:33:10.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30930", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:52.837", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.5.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "glances", "source": "cna", "vendor": "nicolargo"}, "product": "glances", "vendor": "nicolargo"}], "analysis": {"en": {"generated_at": "2026-04-16T09:47:41.252201+00:00", "value": {"mitigation_remediation": ["Upgrade Glances to version 4.5.1 or later, which removes the injection vulnerability.", "If an upgrade is not possible, disable the TimescaleDB export module or ensure it is not enabled for data insertion.", "Sanitize any monitored values that could contain user\u2011controlled input before they reach the export module; adopt strict input validation or escaping practices."], "summary": {"action": "Patch", "impact": "SQL Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects nicolargo Glances versions prior to 4.5.1 on any platform that uses the TimescaleDB export feature. Attackers can trigger it through any monitored entity, including process names, filesystem mount points, network interface names, or container names.", "description_and_impact": "Glances exposes a SQL injection flaw in its TimescaleDB export module when constructing queries via string concatenation with unsanitized monitoring data. The normalize() method only wraps values in single quotes and does not escape embedded quotes, allowing attacker\u2011controlled data such as process names or mount points to inject arbitrary SQL. This weakness falls under code that can lead to data manipulation or disclosure if exploited.", "risk_and_exploitability": "With a CVSS score of 7.3 the vulnerability is considered high severity, yet the EPSS score is less than 1\u202f% and the issue is not listed in the KEV catalog, indicating a very low probability of exploitation in the wild. Based on the description, it is inferred that the attacker would need to influence system monitoring data, which could be possible in environments where Glances is running with elevated privileges or where user input is reflected in monitored names. Successful exploitation would enable arbitrary SQL execution within the TimescaleDB database, potentially exposing or altering stored metrics."}}}}, "created": "2026-03-11T11:49:45.446356+00:00", "updated": "2026-04-16T10:00:14.054906+00:00", "vendors": ["nicolargo", "nicolargo$PRODUCT$glances"]}