gpsd CVE-2026-60122

Exploitation requires the attacker to control GPS input data reaching gpsd (a malicious or spoofed GNSS receiver, or a tampered data feed) AND requires a user to run the gpsprof utility in polar mode against that data so the generated gnuplot script is processed. The specific injection vector is the SKY.satellites[].used field, and the payload must contain the string EOD to prematurely terminate the gnuplot heredoc before appending system() calls. Limiting factors: the vulnerability is not remotely self-triggering - it needs operator interaction (UI:P, running gpsprof in polar mode), only affects gpsd through release-3.27.5, and yields code execution bounded to the privileges of the user invoking gpsprof (no privilege escalation, scope unchanged). It is therefore not exploitable against a default idle gpsd daemon without someone running the profiling tool.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.5 (High) and is internally consistent with the description: exploitation is local/input-driven (AV:L), requires no privileges (PR:N) but does require user interaction (UI:P) - specifically an operator running gpsprof in polar mode against attacker-influenced GPS data. Impact is full confidentiality, integrity and availability loss on the vulnerable system, but scope is unchanged (SC/SI/SA:N), so damage is bounded to the privileges of the user running gpsprof rather than a privilege-crossing compromise. There is no CISA KEV listing and no public POC referenced, so this is not confirmed as actively exploited; EPSS was not provided. Real-world priority is moderate rather than urgent: the attack needs both control of GPS input and a human running a specific diagnostic tool in a specific mode, which limits mass exploitation, but the outcome (arbitrary command execution) is severe where those conditions hold. Note the required user interaction (running gpsprof) is the primary limiting factor and should temper the raw High score.

An attacker who controls a GPS receiver or the data stream feeding gpsd crafts SKY satellite records whose used field contains the EOD heredoc terminator followed by gnuplot system() calls. When an operator later runs gpsprof in polar mode against that data, gnuplot parses the malicious script and executes the injected shell commands with the operator's privileges. No public exploit code is identified at time of analysis, but the technique is straightforward given the described injection point.