Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nicolargo/glances

              develop @ 92156d0
            

Fixes

CVEs

CRITICAL

Peak severity

47.4%

Coverage

Highlights

Denial of Service: 11 prior fixes. Scrutinize any change in this area.

glances/outputs/glances_restful_api.py: most-fixed (4 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The application relies on process execution via custom wrappers like `secure_popen` that have repeatedly failed to safely split arguments or handle shell operators securely, resulting in arbitrary execution. Developers should bypass custom shell emulation and use secure subprocess arrays with shell=False.

Information Disclosure: Sensitive system configurations, raw passwords, SNMP keys, and connection URIs have been frequently exposed to unauthenticated users through REST endpoints and verbose logs. Secure-by-default redaction mechanisms must be applied to all serialization and logging pipelines.

SQL Injection: Export modules dynamically interpolating system statistics or configuration fields into database execution calls without parametrization have enabled SQL/CQL injection. All database outputs must enforce identifier-quoting or parameterized queries.