CVE-2026-60122
published 2026-07-23CVE-2026-60122: gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS…
PriorityP343high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.27%
17.4th percentile
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gpsd | gpsd | <= 3.27.5 | — |
| gpsd_project | gpsd | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.08.5HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
gpsd up to 3.27.5 gpsprof used os command injection (4c06658)
vuldb·2026-07-23·CVSS 7.8
CVE-2026-60122 [HIGH] gpsd up to 3.27.5 gpsprof used os command injection (4c06658)
A vulnerability was found in gpsd up to 3.27.5. It has been classified as very critical. This issue affects some unknown processing of the component gpsprof. The manipulation of the argument used leads to os command injection.
This vulnerability is listed as CVE-2026-60122. The attack may be initiated remotely. There is no available exploit.
It is suggested to install a patch to address this issue.
GHSA
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS command
ghsa_unreviewed·2026-07-23
CVE-2026-60122 [HIGH] CWE-94 gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS command
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.
Red Hat
gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility
vendor_redhat·2026-07-23·CVSS 7.8
CVE-2026-60122 [HIGH] CWE-78 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility
gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.
A flaw was found in gpsd. This code injection vulnerability in the `gpsprof` utility allows an attacker to execute arbitrary o
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility [epel-all]
bugzilla·2026-08-11·CVSS 7.8
CVE-2026-60122 [HIGH] CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility [epel-all]
CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achie
Bugzilla
CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility [fedora-all]
bugzilla·2026-08-11·CVSS 7.8
CVE-2026-60122 [HIGH] CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility [fedora-all]
CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, ach
Bugzilla
CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility
bugzilla·2026-07-23·CVSS 7.8
CVE-2026-60122 [HIGH] CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility
CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.
2026-07-23
Published