CVE-2026-60122 Details
Description
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.
A code injection vulnerability has been identified in the gpsd utility gpsprof, affecting versions through 3.27.5. The issue arises because the SKY.satellites[].used field can be manipulated to inject malicious content, which is then unsanitized and inserted into a gnuplot heredoc data block. This vulnerability allows an attacker controlling GPS input data to execute arbitrary operating system commands. Exploitation occurs when the crafted plot script is processed by gnuplot in polar mode, with the commands executed as the user running gpsprof.
The vulnerability has been fixed in gpsd version 3.27.5 at commit 4c06658. Users should update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93 | [email protected] | Source CodeVendor |
| https://gitlab.com/gpsd/gpsd/-/work_items/406 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/gpsd-gpsprof-code-injection-via-sky-satellites-used-field | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gpsd | <= 3.27.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |