DEBIAN-CVE-2026-58459
gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.
DEBIAN-CVE-2026-58459
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-58459
gpsd
Source reference: /affected/0/package/name
- Affected versions
- 3.22-4.1
Source reference:
/affected/0/versions3.22-4.1+deb12u1Source reference:
/affected/0/versions3.25-1Source reference:
/affected/0/versions3.25-1~exp1Source reference:
/affected/0/versions3.25-1~exp2Source reference:
/affected/0/versions3.25-2Source reference:
/affected/0/versions3.25-2.1~exp1Source reference:
/affected/0/versions3.25-3Source reference:
/affected/0/versions3.25-3~exp1Source reference:
/affected/0/versions3.25-4Source reference:
/affected/0/versions3.25-5Source reference:
/affected/0/versions3.26.1-1Source reference:
/affected/0/versions3.27-1Source reference:
/affected/0/versions3.27-1.1Source reference:
/affected/0/versions3.27.5-0.1Source reference:
/affected/0/versions3.27.5-1Source reference:
/affected/0/versions3.27.5-2Source reference:
/affected/0/versions3.27.5-3Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
gpsd
Source reference: /affected/1/package/name
- Affected versions
- 3.25-5
Source reference:
/affected/1/versions3.25-5+deb13u1Source reference:
/affected/1/versions - Fixed versions
- 3.25-5+deb13u2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
gpsd
Source reference: /affected/2/package/name
- Affected versions
- 3.25-5
Source reference:
/affected/2/versions3.26.1-1Source reference:
/affected/2/versions3.27-1Source reference:
/affected/2/versions3.27-1.1Source reference:
/affected/2/versions3.27.5-0.1Source reference:
/affected/2/versions - Fixed versions
- 3.27.5-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gpsd",
"purl": "pkg:deb/debian/gpsd?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.22-4.1",
"3.22-4.1+deb12u1",
"3.25-1",
"3.25-1~exp1",
"3.25-1~exp2",
"3.25-2",
"3.25-2.1~exp1",
"3.25-3",
"3.25-3~exp1",
"3.25-4",
"3.25-5",
"3.26.1-1",
"3.27-1",
"3.27-1.1",
"3.27.5-0.1",
"3.27.5-1",
"3.27.5-2",
"3.27.5-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58459.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.25-5+deb13u2"
}
]
}
],
"package": {
"name": "gpsd",
"purl": "pkg:deb/debian/gpsd?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.25-5",
"3.25-5+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58459.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.27.5-1"
}
]
}
],
"package": {
"name": "gpsd",
"purl": "pkg:deb/debian/gpsd?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.25-5",
"3.26.1-1",
"3.27-1",
"3.27-1.1",
"3.27.5-0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58459.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58040 · Revision 1
- Added to Heist Feed
- Publisher date