Privilege escalation via nested cmdline injection

OS command injection in Glances 4.5.2 through 4.5.5 allows local users to execute commands via crafted process cmdline values. In glances/actions.py, _sanitize_mustache_dict() sanitizes only top-level strings, so nested list or dictionary values such as process cmdline elements pass through chevron.render() with pipe characters intact and are then interpreted by secure_popen(). Exploitation requires an administrator-configured action template that renders a nested stat field and a local account able to start a visible process; successful injection runs in the Glances process context, commonly root.