CVE-2026-58459: gpsd Command Injection in gpsprof via GPS Device Subtype

Technical summary

CVE-2026-58459 is a command injection vulnerability in gpsd versions up to 3.27.5, fixed at commit 4c06658. The vulnerability resides in gpsprof's handling of the GPS device subtype field, which can originate from DEVICES JSON log entries or NMEA PGRMT sentences. When gpsprof constructs a gnuplot script, it writes the subtype value into a "set title" statement with only double-quote characters escaped. This leaves backticks and other shell metacharacters unescaped, allowing backtick command substitution when gnuplot executes the script. The attack chain requires either: (1) an attacker controlling a physical or emulated GPS device connected to the system, or (2) an attacker modifying stored DEVICES JSON logs that the victim later processes with gpsprof. Execution occurs in the context of the user running gnuplot, typically a local user account.

Business impact

Organizations deploying gpsd in GPS-dependent applications—such as timing infrastructure, vehicle telematics, drone operations, or marine navigation systems—face local privilege escalation and arbitrary code execution risks if an attacker gains control over GPS device metadata. The impact is particularly acute in environments where gpsprof is run by privileged accounts or where GPS logs are shared across untrusted networks. Affected teams should inventory gpsd deployments, assess whether gpsprof is actively used in production workflows, and determine if GPS data sources are controllable by adversaries or insufficiently isolated.

Affected systems

The vulnerability affects gpsd project's gpsd package through release version 3.27.5. Systems running gpsprof workflows that process DEVICES JSON logs or live NMEA streams from GPS devices are at risk. The practical attack surface is narrower than typical remote vulnerabilities: gpsprof is typically invoked manually by users for analysis or diagnostics, not as a daemon. However, automated GPS analysis pipelines, embedded systems using gpsd for navigation, and environments where GPS logs are processed without validation present heightened risk.

Exploitability

Exploitability is moderate to high for environments where an attacker controls GPS data inputs. The vulnerability requires user interaction (rendering a plot with gpsprof and gnuplot), but the injection payload is trivial to craft—a simple backtick-wrapped command in the subtype field. No special privileges are required to trigger the vulnerability; however, the attacker must either: (1) physically or virtually control a GPS device the target system connects to, (2) have write access to DEVICES JSON logs, or (3) intercept and modify NMEA data in transit. For systems where GPS devices are trusted or isolated, exploitability is low. For systems accepting GPS data from untrusted sources or where device metadata is writable by non-admin users, exploitability is high. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update gpsd to a patched version that properly escapes shell metacharacters (including backticks) in the subtype field before constructing gnuplot commands. The fix is available at commit 4c06658 in the gpsd repository. Administrators should verify the patched version through the gpsd project's official releases and advisories. Interim mitigations include: (1) restricting access to GPS devices and DEVICES JSON logs to trusted accounts only, (2) disabling gpsprof if it is not actively used, (3) validating GPS log data before processing with gpsprof, and (4) running gpsprof in isolated environments or containers where command execution impact is limited.

Patch guidance

Apply the fix from commit 4c06658 or later in the gpsd repository. Verify against the official gpsd project advisory for the specific patched release version number. Most Linux distributions package gpsd; administrators should prioritize updates through their distribution's package manager if available. After patching, validate the update by confirming the installed version is no longer 3.27.5 or earlier, and test gpsprof workflows to ensure plot generation continues to function normally. If using gpsd in a container, rebuild container images with the patched gpsd package and redeploy.

Detection guidance

Monitor for suspicious gpsprof or gnuplot process executions that spawn shell commands from the plot generation workflow. Look for: (1) gnuplot processes spawning unexpected child processes (e.g., bash, sh, or curl), (2) gpsprof invocations followed by command execution outside the expected plot-rendering scope, and (3) modifications to DEVICES JSON logs by unexpected users or sources. On systems with verbose logging, capture gnuplot script contents or environment variables passed to gnuplot. Inspect GPS device logs for subtype values containing shell metacharacters (backticks, $(), pipes, semicolons, or ampersands). Behavioral monitoring on systems where gpsd is deployed can alert on anomalous command execution patterns tied to GPS data processing.

Why prioritize this

This vulnerability merits high priority for organizations actively using gpsprof in GPS data analysis workflows, especially in automation or multi-tenant environments where GPS data sources are not fully controlled. The HIGH CVSS score (7.8) reflects the combination of high confidentiality, integrity, and availability impact and low attack complexity. However, the attack surface is limited to local scenarios and requires user interaction or data manipulation. Prioritization should be based on: (1) whether gpsprof is in active use, (2) whether GPS data sources are under attacker control or untrusted, and (3) the privilege level of accounts running gpsprof.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector (Local)—the attacker must have some form of access to the system or its GPS inputs; Attack Complexity (Low)—exploitation requires no special conditions beyond crafting a simple injection payload; Privileges Required (None)—any user can invoke gpsprof and trigger the vulnerability; User Interaction (Required)—the victim must render the plot; Scope (Unchanged)—impact is limited to the system running gpsprof; and Confidentiality/Integrity/Availability (all High)—successful exploitation grants full command execution as the user running gnuplot. The score appropriately penalizes the local-only attack vector but rewards the ease of exploitation and high impact.

Frequently asked questions