Command execution via cross-field operator reconstruction

Command injection in Glances before 4.5.6 allows local users to execute arbitrary commands via attacker-controlled action-template fields. _sanitize_mustache_dict() in glances/actions.py strips shell operators from each Mustache value before chevron.render(), so adjacent unescaped variables can re-form && across a field boundary and pass a chained command to secure_popen(). Exploitation requires a local unprivileged user who can name a process or container and an administrator-configured unescaped template that concatenates fields without a separator; escaped double-brace templates block this path.