Skip to content
Log inStart free trial

GHSA-r2mj-8wgq-73m6 CVE-2021-23418 PYSEC-2021-115 SNYK-PYTHON-GLANCES-1311807

XML External Entity Reference in Glances

Medium PyPI
Severity
0.0 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
1.65%
Chance of exploitation in the next 30 days. Higher than 76.56% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-611 Improper Restriction of XML External Entity Reference
Fix
3.2.1
Upgrade glances to this version or later

Description

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

Affected versions

PyPI

PackageVulnerableFixed in
glances
< 3.2.1
3.2.1
glances
< 3.2.1
3.2.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

glances PyPI → 3.2.1

pip
pip install --upgrade "glances>=3.2.1"
poetry
poetry add "glances>=3.2.1"
uv
uv add "glances>=3.2.1"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
Passive
Confidentiality (vulnerable system)
Low
Integrity (vulnerable system)
Low
Availability (vulnerable system)
Low
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 6.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Weakness

CWE-611: Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it
  • Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-4h34-v6r8-mmjc
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Medium Also affects glances
GHSA-59fj-m2j6-hcxh
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
High Also affects glances
GHSA-73wf-9vmv-5pv9
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
High Also affects glances
GHSA-fp27-88fp-2phg
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
Medium Also affects glances
GHSA-qcpp-8x79-hhp3
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
High Also affects glances
GHSA-3vwc-qwhc-3mj7
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
High Also affects glances
GHSA-w856-8p3r-p338
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
Medium Also affects glances
GHSA-87qc-fj39-wccr
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
High Also affects glances
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor