CriticalFix available
gpsd — security advisory
gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.
- Products
- gpsd
- Affected versions
- 3.22-4.1, 3.22-4.1+deb12u1, 3.25-1, 3.25-1~exp1, 3.25-1~exp2, 3.25-2, 3.25-2.1~exp1, 3.25-3, 3.25-3~exp1, 3.25-4, 3.25-5, 3.25-5+deb13u1, 3.26.1-1, 3.27-1, 3.27-1.1, 3.27.5-0.1, 3.27.5-1, 3.27.5-2, 3.27.5-3
- Fixed versions
- 3.25-5+deb13u2, 3.27.5-1
- CVEs
- CVE-2026-58459
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 12:18 UTC · Revision 2
Source evidence
gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.
osv:DEBIAN-CVE-2026-58459
gpsd
Fixed versions: Not specified
gpsd
Fixed versions: 3.25-5+deb13u2
gpsd
Fixed versions: 3.27.5-1
Complete source record
{
"id": "794d4fc0450734df7db17092b40ab128fd8d01b4b654dd1f5cff9d54b3b0d05a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-58459",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-58459",
"summary": "gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.",
"evidence": "osv:DEBIAN-CVE-2026-58459",
"products": [
{
"name": {
"value": "gpsd",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.22-4.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.22-4.1+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3.25-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.25-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "3.25-1~exp2",
"evidence": "/affected/0/versions"
},
{
"value": "3.25-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.25-2.1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "3.25-3",
"evidence": "/affected/0/versions"
},
{
"value": "3.25-3~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "3.25-4",
"evidence": "/affected/0/versions"
},
{
"value": "3.25-5",
"evidence": "/affected/0/versions"
},
{
"value": "3.26.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.27-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.27-1.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.27.5-0.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.27.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.27.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.27.5-3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "gpsd",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.25-5+deb13u2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "3.25-5",
"evidence": "/affected/1/versions"
},
{
"value": "3.25-5+deb13u1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "gpsd",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.27.5-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.25-5",
"evidence": "/affected/2/versions"
},
{
"value": "3.26.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.27-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.27-1.1",
"evidence": "/affected/2/versions"
},
{
"value": "3.27.5-0.1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2026-58459",
"aliases": [
"DEBIAN-CVE-2026-58459"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gpsd",
"purl": "pkg:deb/debian/gpsd?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.22-4.1",
"3.22-4.1+deb12u1",
"3.25-1",
"3.25-1~exp1",
"3.25-1~exp2",
"3.25-2",
"3.25-2.1~exp1",
"3.25-3",
"3.25-3~exp1",
"3.25-4",
"3.25-5",
"3.26.1-1",
"3.27-1",
"3.27-1.1",
"3.27.5-0.1",
"3.27.5-1",
"3.27.5-2",
"3.27.5-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58459.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.25-5+deb13u2"
}
]
}
],
"package": {
"name": "gpsd",
"purl": "pkg:deb/debian/gpsd?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.25-5",
"3.25-5+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58459.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.27.5-1"
}
]
}
],
"package": {
"name": "gpsd",
"purl": "pkg:deb/debian/gpsd?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.25-5",
"3.26.1-1",
"3.27-1",
"3.27-1.1",
"3.27.5-0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58459.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T11:47:26.963344240Z",
"provider": "osv",
"upstream": [
"CVE-2026-58459"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-58459"
]
},
"related_cves": [
{
"value": "CVE-2026-58459",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 450823,
"published_at": "2026-07-09T17:17:01.493+00:00"
}