CVE-2021-23418

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	Glances	>= unspecified, < 3.2.1

References

https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94Patch, Third Party Advisory
https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07aPatch, Third Party Advisory
https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32Patch, Third Party Advisory
https://github.com/nicolargo/glances/issues/1025Exploit, Issue Tracking, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807Patch, Third Party Advisory
https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94Patch, Third Party Advisory
https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07aPatch, Third Party Advisory
https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32Patch, Third Party Advisory
https://github.com/nicolargo/glances/issues/1025Exploit, Issue Tracking, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807Patch, Third Party Advisory

Timeline

Published: Jul 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-234199.8This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototyp CVE-2021-23424.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.34 an CVE-2021-234209.8This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadg CVE-2021-234219.8All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.CVE-2021-234227.8This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is proce CVE-2021-234237.5This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw CVE-2021-234247.5This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an ex CVE-2021-234255.3All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.CVE-2021-234267.5This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging CVE-2021-234279.8This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction CVE-2021-234289.8This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing CVE-2021-234297.5All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled wit