Affected: nicolargo glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1.

Affected: PyPI: Glances

### Summary

The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names.

Root Cause: The normalize() function uses f"'{value}'" for string values without escaping single quotes within the value. The resulting strings are concatenated into INSERT queries via string formatting and executed directly with cur.execute() — no parameterized queries are used.

#### Affected Code - _File: glances/exports/glances_timescaledb/__init__.py, lines 79-93 (normalize function)_ ``` def normalize(self, value): """Normalize the value to be exportable to TimescaleDB.""" if value is None: return 'NULL' if isinstance(value, bool): return str(value).upper() if isinstance(value, (list, tuple)): # Special case for list of one boolean if len(value) == 1 and isinstance(value[0], bool): return str(value[0]).upper() return ', '.join([f"'{v}'" for v in value]) if isinstance(value, str): return f"'{value}'" # <-- NO ESCAPING of single quotes within value

return f"{value}" ```

- _File: glances/exports/glances_timescaledb/__init__.py, lines 201-205 (query construction)_ ``` # Insert the data insert_list = [f"({…

Affected: PyPI: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1.