Skip to content
Heist/ feed
CriticalFix available

gpsd security update

Type: advisorySource: OSV1 source record

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. Security Fix(es): gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.(CVE-2026-58459) gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data b

Announced Source revision 1
Original source ↗

OESA-2026-4220

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:OESA-2026-4220

gpsd

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
3.25-6.oe2403sp4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.25-6.oe2403sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "gpsd",
      "purl": "pkg:rpm/openEuler/gpsd&distro=openEuler-24.03-LTS-SP4",
      "ecosystem": "openEuler:24.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4220.json"
    },
    "ecosystem_specific": {
      "src": [
        "gpsd-3.25-6.oe2403sp4.src.rpm"
      ],
      "x86_64": [
        "gpsd-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-clients-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-debuginfo-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-debugsource-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-devel-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-libs-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-qt-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-qt-devel-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-xclients-3.25-6.oe2403sp4.x86_64.rpm",
        "python3-gpsd-3.25-6.oe2403sp4.x86_64.rpm"
      ],
      "aarch64": [
        "gpsd-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-clients-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-debuginfo-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-debugsource-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-devel-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-libs-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-qt-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-qt-devel-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-xclients-3.25-6.oe2403sp4.aarch64.rpm",
        "python3-gpsd-3.25-6.oe2403sp4.aarch64.rpm"
      ]
    }
  }
]

Publisher severity

critical

Source reference: /database_specific/severity

Event
#52153 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement