CVE-2026-58459

gpsd gpsprof Command Injection via gnuplot plot title subtype field

State: Published
Severity: 8.4 High
Published: Jul 9, 2026
Updated: Jul 28, 2026
Reserved: Jun 30, 2026

Description

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.

Scores

CVSS	Score	Vector	Source
4.0	8.4 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
gpsdntpsec	3.27.5 and earlierAffected 4c06658e988f4ced1a7a574ce082a22ef625df56 and earlierAffected

References

https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267issue-tracking
Patch Commit (1)patch
Patch Commit (2)patch
Patch Commit (3)patch
https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-plot-title-subtype-fieldthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.