Vulnerability Description
gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gpsd Project | Gpsd | <= 3.27.5 |
Related Weaknesses (CWE)
References
- https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf58aa940132e630870af061dc88537Patch
- https://github.com/ntpsec/gpsd/commit/4c06658e988f4ced1a7a574ce082a22ef625df56Patch
- https://github.com/ntpsec/gpsd/commit/5581ba196d826a984fbfaf792b7d58535f9911cePatch
- https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267ExploitIssue TrackingThird Party Advisory
- https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-Third Party Advisory
FAQ
What is CVE-2026-58459?
CVE-2026-58459 is a vulnerability with a CVSS score of 7.8 (HIGH). gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell co...
How severe is CVE-2026-58459?
CVE-2026-58459 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-58459?
Check the references section above for vendor advisories and patch information. Affected products include: Gpsd Project Gpsd.