Vulnerability-Lookup

rlsa-2026:51075

Vulnerability from osv_rocky

Published

2026-08-07 12:07

Modified

2026-08-08 00:10

Summary

Important: gpsd security update

Details

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The Rocky Enterprise Software Foundation support for this package is limited. See https://access.redhat.com/support/policy/gpsd-support for more details.

Security Fix(es):

gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution (CVE-2026-58459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:51075	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2498575	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:10",
        "name": "gpsd",
        "purl": "pkg:rpm/rocky-linux/gpsd?distro=rocky-linux-10\u0026epoch=1"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "AppStream"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:3.26.1-3.el10_2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "details": "gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.  The Rocky Enterprise Software Foundation support for this package is limited. See https://access.redhat.com/support/policy/gpsd-support for more details.\n\nSecurity Fix(es):\n\n* gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution (CVE-2026-58459)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:51075",
  "modified": "2026-08-08T00:10:44.137210Z",
  "published": "2026-08-07T12:07:56.374775Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:51075"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498575"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: gpsd security update",
  "upstream": [
    "CVE-2026-58459"
  ]
}

CVE-2026-58459 (GCVE-0-2026-58459)

Vulnerability from cvelistv5 – Published: 2026-07-09 16:14 – Updated: 2026-07-28 01:49 X_Open Source

Title

gpsd gpsprof Command Injection via gnuplot plot title subtype field

Summary

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck

References

5 references

URL	Tags
https://gitlab.com/gpsd/gpsd/-/work_items/404#not…	issue-tracking
https://github.com/ntpsec/gpsd/commit/5581ba196d8…	patch
https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf…	patch
https://github.com/ntpsec/gpsd/commit/4c06658e988…	patch
https://www.vulncheck.com/advisories/gpsd-gpsprof…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ntpsec	gpsd	Affected: 0 , ≤ 3.27.5 (semver) Affected: 0 , ≤ 4c06658e988f4ced1a7a574ce082a22ef625df56 (git)

Date Public

2026-07-01 00:00

Credits

CuB3y0nd VulnCheck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58459",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T01:00:37.186058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T01:01:34.929Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/ntpsec/gpsd",
          "product": "gpsd",
          "repo": "https://github.com/ntpsec/gpsd",
          "vendor": "ntpsec",
          "versions": [
            {
              "lessThanOrEqual": "3.27.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4c06658e988f4ced1a7a574ce082a22ef625df56",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gpsd_project:gpsd:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.27.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "CuB3y0nd"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulnCheck"
        }
      ],
      "datePublic": "2026-07-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:49:48.157Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267"
        },
        {
          "name": "Patch Commit (1)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ntpsec/gpsd/commit/5581ba196d826a984fbfaf792b7d58535f9911ce"
        },
        {
          "name": "Patch Commit (2)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf58aa940132e630870af061dc88537"
        },
        {
          "name": "Patch Commit (3)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ntpsec/gpsd/commit/4c06658e988f4ced1a7a574ce082a22ef625df56"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-plot-title-subtype-field"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "gpsd gpsprof Command Injection via gnuplot plot title subtype field",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-58459",
    "datePublished": "2026-07-09T16:14:02.757Z",
    "dateReserved": "2026-06-30T20:20:33.789Z",
    "dateUpdated": "2026-07-28T01:49:48.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

rlsa-2026:51075

Vulnerability from osv_rocky

CVE-2026-58459 (GCVE-0-2026-58459)

Tags

Sightings

Nomenclature