Which versions of gpsd are affected by CVE-2026-60122?

gpsd's gpsprof utility (versions through 3.27.5) contains an OS command injection vulnerability enabling arbitrary code execution when an attacker controls GPS input data.. A patch is available.

How to fix or mitigate CVE-2026-60122?

Within 24 hours, identify systems running gpsd version 3.27.5 or earlier, particularly those using gpsprof with external or untrusted GPS input sources. Within 7 days, upgrade gpsd to release 3.27.6 or later on all affected systems. Within 30 days, verify successful patching across the estate and audit GPS input trust boundaries to prevent similar injection attacks.

gpsd CVE-2026-60122

Q: What is the CVSS score of CVE-2026-60122?

CVE-2026-60122 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-48380 HIGH

Code Injection (CWE-94)

2026-07-23 VulnCheck

GHSA-9m96-crvq-5qcj

RCE Command Injection Code Injection Red Hat Gpsd Suse

8.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Attacker-supplied GPS data plus a required operator action gives AV:L/UI:R, no privileges needed (PR:N), and command execution yields full C/I/A within the operator's scope (S:U).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:21 vuln.today

CVE Published

Jul 23, 2026 - 19:18 cve.org

HIGH 8.5

DescriptionCVE.org

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.

AnalysisAI

OS command injection in gpsd's gpsprof profiling utility (through release-3.27.5) lets an attacker who controls GPS input inject shell commands via the SKY.satellites[].used field. The value is written unsanitized into a gnuplot heredoc, so a crafted used value containing the heredoc terminator EOD closes the data block early and appends gnuplot system() calls that execute as the user running gpsprof in polar mode. No public exploit identified at time of analysis; the flaw is code-execution class (CWE-94) with a CVSS 4.0 base score of 8.5.

Technical ContextAI

gpsd is the GPS daemon and toolkit that parses feeds from GNSS receivers and exposes them to client applications on Linux/Unix systems. The affected component, gpsprof, is a Python profiling/plotting helper that collects SKY reports (satellite metadata, including the per-satellite used flag) and emits a gnuplot script to visualize signal geometry. The vulnerability is CWE-94 (Improper Control of Generation of Code): gpsprof embeds satellite data inside a gnuplot heredoc (a here-document delimited by the EOD marker) without escaping or validating field contents. Because gnuplot supports a system() function for shell command execution, any attacker-controlled data that can break out of the heredoc's data context is promoted from data to executable script. CPE cpe:2.3:a:gpsd:gpsd:*:*:*:*:*:*:*:* confirms the gpsd application itself is the affected product across versions up to the fix.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the gpsd fix from commit 4c06658 / https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93, or upgrade to the first tagged gpsd release that includes it once published (versions through release-3.27.5 are vulnerable). Until a packaged release is available, the most effective compensating control is to avoid running gpsprof (especially in polar mode) against GPS feeds from untrusted or attacker-reachable receivers, since exploitation depends on that operator action. Where profiling is required, run gpsprof against captured/validated data from trusted receivers only, or run it under a low-privilege, sandboxed account so that any resulting command execution is confined; the trade-off is reduced convenience for operators and loss of live-plotting workflows. Restricting who can supply GPS input to the profiled daemon (physical/network access to the receiver source) further reduces exposure. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/gpsd-gpsprof-code-injection-via-sky-satellites-used-field) and upstream work item https://gitlab.com/gpsd/gpsd/-/work_items/406 for details.