Skip to content
Fencer Vulns
high 7.8

CVE-2026-60122 json

gpsd gpsprof Code Injection via SKY.satellites used Field

published 2026-07-23 3 mo ago modified 2026-07-30 3 mo ago also EUVD-2026-48380

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.

Patch / fix

  • gpsd Debian 13 3.25-5+deb13u2
  • gpsd Debian 14 3.27.5-1

debian advisories DEBIAN-CVE-2026-60122

  • gpsd-minimal RHEL 9 1:3.26.1-2.el9_8.2
  • gpsd-minimal-clients RHEL 9 1:3.26.1-2.el9_8.2
  • gpsd RHEL 10.2 1:3.26.1-3.el10_2.2
  • gpsd-clients RHEL 10.2 1:3.26.1-3.el10_2.2
  • python3-gpsd RHEL 10.2 1:3.26.1-3.el10_2.2

red hat advisories RHSA-2026:65606RHSA-2026:65162

  • gpsd openSUSE Tumbleweed 3.27.5-4.1

opensuse advisories openSUSE-SU-2026:11891-1

  • gpsd AlmaLinux 10 1:3.26.1-3.el10_2.2
  • gpsd-clients AlmaLinux 10 1:3.26.1-3.el10_2.2
  • python3-gpsd AlmaLinux 10 1:3.26.1-3.el10_2.2
  • gpsd-minimal AlmaLinux 9 1:3.26.1-2.el9_8.2
  • gpsd-minimal-clients AlmaLinux 9 1:3.26.1-2.el9_8.2

almalinux advisories ALSA-2026:65162ALSA-2026:65606

  • gpsd-minimal Rocky Linux 9 1:3.26.1-2.el9_8.2
  • gpsd Rocky Linux 10 1:3.26.1-3.el10_2.2

rocky linux advisories RLSA-2026:65606RLSA-2026:65162

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-60122 updated cvss 7.8

gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility

  • Red Hat Enterprise Linux AppStream (v. 9) gpsd-minimal 3.26.1-2.el9_8.2, gpsd-minimal-clients 3.26.1-2.el9_8.2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:65606
  • Red Hat Enterprise Linux AppStream (v. 10) gpsd 3.26.1-3.el10_2.2, gpsd-clients 3.26.1-3.el10_2.2, python3-gpsd 3.26.1-3.el10_2.2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:65162

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • gpsd gpsd

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.