{"id":"CVE-2021-23418","aliases":["DEBIAN-CVE-2021-23418","EUVD-2021-0094","GHSA-r2mj-8wgq-73m6","PYSEC-2021-115","SNYK-PYTHON-GLANCES-1311807","UBUNTU-CVE-2021-23418","USN-5187-1","openSUSE-SU-2026:11674-1"],"status":"published","title":"XML External Entity (XXE) Injection","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01653,"percentile":0.76902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2021-07-29T17:50:12Z","modified":"2026-10-23T18:04:49Z","fixes":[{"ecosystem":"PyPI","package":"glances","fixed_in":["3.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"glances","fixed_in":["3.2.3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glances","fixed_in":["3.2.3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glances","fixed_in":["3.2.3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glances","fixed_in":["2.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glances","fixed_in":["2.11.1-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"glances","fixed_in":["3.1.3-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}],"versions":["1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.1.1","1.4.2","1.4.2.1","1.5","1.5.1","1.5.2","1.6","1.6.1","1.7","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","2.0","2.0.1","2.1","2.1.1","2.1.2","2.10","2.11","2.11.1","2.2","2.2.1","2.3","2.4","2.4.1","2.4.2","2.5","2.5.1","2.6","2.6.1","2.6.2","2.7","2.7.1","2.8","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.9.0","2.9.1","3.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.4.1","3.1.5","3.1.6","3.1.6.1","3.1.6.2","3.1.7","3.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"glances","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"85d5a6b4af31fcf785d5a61086cbbd166b40b07a"},{"fixed":"9d6051be4a42f692392049fdbfc85d5dfa458b32"},{"fixed":"4b87e979afdc06d98ed1b48da31e69eaa3a9fb94"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}],"versions":["1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.1.1","1.4.2","1.4.2.1","1.5","1.5.1","1.5.2","1.6","1.6.1","1.7","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","2.0","2.0.1","2.1","2.1.1","2.1.2","2.10","2.11","2.11.1","2.2","2.2.1","2.3","2.4","2.4.1","2.4.2","2.5","2.5.1","2.6","2.6.1","2.6.2","2.7","2.7.1","2.8","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.9.0","2.9.1","3.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.4.1","3.1.5","3.1.6","3.1.6.1","3.1.6.2","3.1.7","3.2.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-1ubuntu0.1~esm1"}]}],"versions":["2.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-3ubuntu0.1~esm1"}]}],"versions":["2.10-2","2.11.1-1","2.11.1-2","2.11.1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1ubuntu0.1~esm1"}]}],"versions":["3.1.0-1","3.1.1-1","3.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-1ubuntu0.1~esm1"}]}],"versions":["2.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-3ubuntu0.1~esm1"}]}],"versions":["2.10-2","2.11.1-1","2.11.1-2","2.11.1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1ubuntu0.1~esm1"}]}],"versions":["3.1.0-1","3.1.1-1","3.1.3-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Glances","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.6-1.1"}]}],"bundled":6}],"products":[{"vendor":"glances_project","product":"glances"},{"vendor":"nicolargo","product":"glances"}],"references":[{"url":"https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","advisory","report"]},{"url":"https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/nicolargo/glances/issues/1025","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23418","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r2mj-8wgq-73m6","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2021-115.yaml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23418","tags":["advisory"]},{"url":"https://github.com/nicolargo/glances","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-23418","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5187-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23418","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68520","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-23418","title":"XML External Entity (XXE) Injection","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.","status":"published","published":"2021-07-29T17:50:12.851Z","modified":"2024-09-16T17:38:39.943Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-0094","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.","status":"published","published":"2021-07-29T17:50:12Z","modified":"2024-09-16T17:38:39Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:40.170355Z"}],"ghsa":[{"id":"GHSA-r2mj-8wgq-73m6","title":"XML External Entity Reference in Glances","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.\n","status":"published","published":"2021-08-09T20:43:14Z","modified":"2024-09-20T20:59:25Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2021-23418","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.","status":"published","published":"2021-07-29T18:15:07.727Z","modified":"2026-06-17T03:38:43.62Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"CVE-2021-23418","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.","status":"published","published":"2021-07-29T18:15:07.727Z","modified":"2026-10-20T10:54:37.644804196Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-23418","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.","status":"published","published":"2021-07-29T18:15:07.727Z","modified":"2026-10-23T18:04:49.994241318Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-r2mj-8wgq-73m6","title":"XML External Entity Reference in Glances","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.\n","status":"published","published":"2021-08-09T20:43:14Z","modified":"2024-09-20T21:00:55.619566Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"UBUNTU-CVE-2021-23418","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.","status":"published","published":"2021-07-29T18:15:00Z","modified":"2026-02-04T02:45:26.326088Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"openSUSE-SU-2026:11674-1","title":"glances-common-4.5.6-1.1 on GA media","description":"These are all security issues fixed in the glances-common-4.5.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:08.662507132Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"PYSEC-2021-115","description":"The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.\n","status":"published","published":"2021-07-29T18:15:00Z","modified":"2023-11-08T04:05:08.497336Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"USN-5187-1","title":"glances vulnerability","description":"It was discovered that Glances incorrectly parsed untrusted XML data due to\nusage of xmlrpclib. An attacker could possibly use this to perform an External\nEntity (XXE) Injection and cause the host system to crash.\n","status":"published","published":"2022-07-25T12:04:48Z","modified":"2026-06-25T13:30:53.392814058Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}