CVE-2026-58459

CriticalCVSS 9.6/10Last modified Oct 25, 2026

Description

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
ntpsec	gpsd	<= 3.27.5; <= 4c06658e988f4ced1a7a574ce082a22ef625df56

References

https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf58aa940132e630870af061dc88537Patch
https://github.com/ntpsec/gpsd/commit/4c06658e988f4ced1a7a574ce082a22ef625df56Patch
https://github.com/ntpsec/gpsd/commit/5581ba196d826a984fbfaf792b7d58535f9911cePatch
https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267Exploit, Issue Tracking, Third Party Advisory
https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-plot-title-subtype-fieldThird Party Advisory

Timeline

Published: Jul 9, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-58465.7The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for au CVE-2026-584607.7react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious application to write files o CVE-2026-584657.5Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/bloc CVE-2026-584669.8AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as th CVE-2026-584677.5Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read ar CVE-2026-584685.5NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administ CVE-2026-584697.5GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function wit CVE-2026-58474.3A vulnerability has been found in code-projects Movie Ticketing System 1.0. Impacted is an unknown function of the file /db/moviedb.sql of t CVE-2026-584705.3GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within sr CVE-2026-584717.1GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/u CVE-2026-584727.1GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/c CVE-2026-584739.1Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM prov