Command Injection in gpsd via gpsprof gnuplot Title

Executive Summary

CVE-2026-58459 is a command injection vulnerability in the gpsprof tool of gpsd versions up to 3.27.5. It occurs because the subtype field from GPS device metadata, which can be controlled by an attacker, is inserted into a gnuplot plot title without proper escaping. Specifically, only double-quote characters are escaped, but backtick characters are not, allowing an attacker to embed backtick payloads that execute arbitrary shell commands when the victim renders the plot using gpsprof and gnuplot.

The subtype value is sourced from either a DEVICES JSON log entry or an NMEA PGRMT sentence. Because the input is not properly sanitized, an attacker can inject malicious commands that run with the privileges of the user running gnuplot.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary shell commands on the system where gpsprof and gnuplot are used to render GPS device data plots. The commands run with the privileges of the user executing gnuplot, which could lead to unauthorized access, data manipulation, or disruption of services.

The impact includes potential compromise of confidentiality, integrity, and availability of the affected system. Although the vulnerability does not grant root privileges by itself, if gnuplot is run with elevated permissions, the attacker could gain higher-level control.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious or malformed GPS device subtype values that include backtick (`) characters or other command-substitution syntax in DEVICES JSON log entries or NMEA PGRMT sentences.

Detection can involve inspecting logs or network traffic for GPS metadata containing backticks or unusual characters in the subtype field that could be used to inject shell commands.

Specific commands to detect exploitation attempts might include searching logs or input data for backticks or suspicious patterns, for example:

• grep -r '\`' /path/to/gpsd/logs
• tcpdump -A -s 0 port 2947 | grep '\`'
• Inspect NMEA sentences for PGRMT sentences containing backticks or unusual characters.

Additionally, monitoring for unexpected execution of gnuplot or unusual gnuplot plot titles containing backticks could help identify exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update gpsd to a version that includes the fix for this vulnerability, specifically the commit 4c06658 or later, which properly escapes backticks and other special characters in the gpsprof tool.

If updating is not immediately possible, avoid processing untrusted GPS device subtype data or rendering plots with gpsprof and gnuplot from untrusted sources.

Restrict access to gpsd and gpsprof services to trusted users and networks to reduce the risk of exploitation.

Consider monitoring and filtering input data to gpsd to prevent injection of malicious subtype values containing backticks or command substitution syntax.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-58459 vulnerability allows attackers to execute arbitrary shell commands through a command injection flaw in gpsprof when processing GPS device subtype values. This can lead to unauthorized command execution with the privileges of the user running gnuplot.

Such unauthorized command execution can compromise the confidentiality, integrity, and availability of systems processing GPS data, potentially leading to data breaches or system disruptions.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the ability to execute arbitrary commands and potentially access or manipulate sensitive data could result in violations of these regulations, which require protection of personal and sensitive information.

Organizations using affected versions of gpsd should consider this vulnerability a risk to compliance frameworks that mandate strict controls on data security and system integrity.

Useful 0 Not Useful 0