Homepage

OS Command Injection The advisory has been revoked - it doesn't affect any version of package gpsd  (opens in a new tab)

Threat Intelligence

EPSS
0.27% (17th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-GPSD-18630671
  • published12 Aug 2026
  • disclosed23 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 23 Jul 2026

CVE-2026-60122  (opens in a new tab)
CWE-78  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gpsd package and not the gpsd package as distributed by RHEL.

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.