CVE-2026-58459

critical

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device su…

Vendor / product: Gpsd Project — gpsd

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.

CVSS

9.6

9.6 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-07-09 17:17

Modified: 2026-10-25 17:10

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 07:07 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

gpsd_project / gpsd ≤3.27.5

Weakness classification (CWE)

CWE-78

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf58aa940132e630870af061dc88537

Patch / mitigation: https://github.com/ntpsec/gpsd/commit/4c06658e988f4ced1a7a574ce082a22ef625df56

Patch / mitigation: https://github.com/ntpsec/gpsd/commit/5581ba196d826a984fbfaf792b7d58535f9911ce

References

https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf58aa940132e630870af061dc88537 disclosure@vulncheck.com
https://github.com/ntpsec/gpsd/commit/4c06658e988f4ced1a7a574ce082a22ef625df56 disclosure@vulncheck.com
https://github.com/ntpsec/gpsd/commit/5581ba196d826a984fbfaf792b7d58535f9911ce disclosure@vulncheck.com
https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267 disclosure@vulncheck.com
https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-plot-title... disclosure@vulncheck.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores