CVE catalog

CVE-2026-60122

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS command

[CVE catalog]

Severity
High · CVSS 8.5
Published
Source
[NVD] · [CVE record]
EPSS
0.27% · Oct 25, 2026

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangpsdsid3.27.5-3fixed
Debiangpsdforky3.27.5-3fixed
Debiangpsdtrixie3.25-5+deb13u2fixed
Debiangpsdbookworm3.22-4.1+deb12u1vulnerable
Opensusegpsdtumbleweed3.27.5-4.1fixed
Ubuntugpsd16.043.11-3vulnerable
Ubuntugpsd16.043.15-2vulnerable
Ubuntugpsd16.043.15-2build1vulnerable
Ubuntugpsd18.043.16-4vulnerable
Ubuntugpsd18.043.17-3vulnerable
Ubuntugpsd18.043.17-5vulnerable
Ubuntugpsd20.043.17-7vulnerable
Ubuntugpsd20.043.19-3vulnerable
Ubuntugpsd20.043.20-1vulnerable
Ubuntugpsd20.043.20-3vulnerable
Ubuntugpsd20.043.20-4vulnerable
Ubuntugpsd20.043.20-4build1vulnerable
Ubuntugpsd20.043.20-5ubuntu1vulnerable
Ubuntugpsd20.043.20-6vulnerable
Ubuntugpsd20.043.20-8vulnerable
Ubuntugpsd20.043.20-8ubuntu0.1vulnerable
Ubuntugpsd20.043.20-8ubuntu0.2vulnerable
Ubuntugpsd20.043.20-8ubuntu0.4vulnerable
Ubuntugpsd22.043.22-4vulnerable
Ubuntugpsd22.043.22-4ubuntu1vulnerable
Ubuntugpsd22.043.22-4ubuntu2vulnerable
Ubuntugpsd22.043.22-4ubuntu2.1vulnerable
Ubuntugpsd24.043.25-2ubuntu2vulnerable
Ubuntugpsd24.043.25-3ubuntu2vulnerable
Ubuntugpsd24.043.25-3ubuntu3vulnerable
Ubuntugpsd24.043.25-3ubuntu3.1vulnerable
Ubuntugpsd24.043.25-3ubuntu3.2vulnerable
Ubuntugpsd26.043.25-5ubuntu1vulnerable
Ubuntugpsd26.043.27-1.1vulnerable
Ubuntugpsd26.043.27-1.1ubuntu1vulnerable
Ubuntugpsd26.043.27.5-0.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangpsdsourcesid3.27.5-1not yet assignedNot reportedNot reported
Debiangpsdsourceforky3.27.5-1not yet assignedNot reportedNot reported
Debiangpsdsourcetrixie3.25-5+deb13u2not yet assignedNot reportedNot reported
Debiangpsdsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Opensusegpsdrpmtumbleweed3.27.5-4.1Not reportedOPENSUSE-SU-2026:11891-1Not reported

Notes

[bookworm] gpsd: Minor issue; code injection confined to the gpsprof diagnostic client via a hostile gpsd JSON stream or replayed log, local and requires user interaction

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gpsd]Affected
    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

  • [gpsd-clients]Affected

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

  • [gpsd-tools]Affected

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

  • [libgps28]Affected

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

  • [libgps-dev]Affected

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

  • [libqgpsmm28]Affected

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

  • [libqgpsmm-dev]Affected

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

  • [python3-gps]Affected

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · gpsd · debian · bookworm; nvd · gpsd · debian · 12

[Debian 13 (Trixie)]

  • [gpsd]Affected
    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

  • [gpsd-clients]Affected

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

  • [gpsd-tools]Affected

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

  • [libgps30t64]Affected

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

  • [libgps-dev]Affected

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

  • [libqgpsmm30t64]Affected

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

  • [libqgpsmm-dev]Affected

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

  • [python3-gps]Affected

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Affected · Fixed: 3.25-5+deb13u2

      nvd · gpsd · debian · 13

[openSUSE Tumbleweed]

  • [gpsd]Affected

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Affected · Fixed: 3.27.5-4.1

      nvd · gpsd · opensuse · tumbleweed

  • [gpsd-clients]Unknown

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.27.5-4.1

      Version impact unknown

      nvd · gpsd · opensuse · tumbleweed

  • [gpsd-devel]Unknown

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.27.5-4.1

      Version impact unknown

      nvd · gpsd · opensuse · tumbleweed

  • [gpsd-qt6-devel]Unknown

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.27.5-4.1

      Version impact unknown

      nvd · gpsd · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]