Skip to content
Fencer Vulns
high 7.8

CVE-2026-58459 json

gpsd gpsprof Command Injection via gnuplot plot title subtype field

published 2026-07-09 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-42622

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.

Patch / fix

  • gpsd Debian 13 3.25-5+deb13u2
  • gpsd Debian 14 3.27.5-1

debian advisories DEBIAN-CVE-2026-58459

  • gpsd-minimal RHEL 9 1:3.26.1-2.el9_8.1
  • gpsd-minimal-clients RHEL 9 1:3.26.1-2.el9_8.1
  • gpsd RHEL 10.2 1:3.26.1-3.el10_2.1
  • gpsd-clients RHEL 10.2 1:3.26.1-3.el10_2.1
  • python3-gpsd RHEL 10.2 1:3.26.1-3.el10_2.1

red hat advisories RHSA-2026:51153RHSA-2026:51075

  • gpsd openSUSE Tumbleweed 3.27.5-3.1

opensuse advisories openSUSE-SU-2026:11276-1

  • gpsd AlmaLinux 10 1:3.26.1-3.el10_2.1
  • gpsd-clients AlmaLinux 10 1:3.26.1-3.el10_2.1
  • python3-gpsd AlmaLinux 10 1:3.26.1-3.el10_2.1
  • gpsd-minimal AlmaLinux 9 1:3.26.1-2.el9_8.1
  • gpsd-minimal-clients AlmaLinux 9 1:3.26.1-2.el9_8.1

almalinux advisories ALSA-2026:51075ALSA-2026:51153

  • gpsd Rocky Linux 10 1:3.26.1-3.el10_2.1
  • gpsd-minimal Rocky Linux 9 1:3.26.1-2.el9_8.1

rocky linux advisories RLSA-2026:51075RLSA-2026:51153

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-58459 updated cvss 7.8

gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution

  • Red Hat Enterprise Linux AppStream (v. 9) gpsd-minimal 3.26.1-2.el9_8.1, gpsd-minimal-clients 3.26.1-2.el9_8.1
    fixed: vendor fix RHSA-2026:51153
  • Red Hat Enterprise Linux AppStream (v. 10) gpsd 3.26.1-3.el10_2.1, gpsd-clients 3.26.1-3.el10_2.1, python3-gpsd 3.26.1-3.el10_2.1
    fixed: vendor fix RHSA-2026:51075

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

2.86% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.com https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 4.0 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

  • ntpsec gpsd

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.