Code Injection Vulnerability in gpsd's gpsprof Utility

CVE-2026-60122

What is CVE-2026-60122?

The gpsd software package, specifically version 3.27.5, has a code injection vulnerability found in the gpsprof utility. This flaw enables an attacker who has control over GPS input data to execute arbitrary operating system commands. The attack is possible due to unsanitized input in the SKY.satellites[].used field, which can be manipulated to include a string that prematurely terminates a heredoc in a gnuplot data block. By appending specific gnuplot system commands, an attacker can gain the ability to execute commands as the user running the gpsprof utility when the generated plot script is processed by gnuplot in polar mode.

References