CVE-2026-60122
Received Received - Intake

Code Injection in gpsd gpsprof Utility

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-24
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-60122
EUVD
EUVD-2026-48380

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a code injection vulnerability in gpsd versions up to 3.27.5 affecting the gpsprof utility. Attackers controlling GPS input data can execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field. The unsanitized field is inserted into a gnuplot heredoc data block, and by including the string EOD, the attacker can terminate the heredoc early and append gnuplot system() calls, leading to OS command execution when the plot script is processed by gnuplot in polar mode.

Detection Guidance

To detect CVE-2026-60122, check if gpsd version 3.27.5 or earlier is installed. Run 'gpsd -V' to verify the version. If using gpsprof, test with malicious GPS data containing 'EOD' in the SKY.satellites[].used field to see if arbitrary commands execute.

Impact Analysis

If you run gpsprof with malicious GPS data, an attacker could execute arbitrary commands on your system with the same privileges as the user running gpsprof. This could lead to data theft, system compromise, or further network infiltration, depending on the user's permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected gpsd versions may face compliance violations if exploited, resulting in potential fines or legal consequences.

Mitigation Strategies

Upgrade gpsd to a version beyond commit 4c06658 or apply the patch from commit 5a9c44a4. Sanitize the 'used' field in SKY.satellites to prevent 'EOD' or newline injection. Avoid running gpsprof with untrusted GPS input data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-60122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart