Homepage

OS Command Injection The advisory has been revoked - it doesn't affect any version of package gpsd-clients  (opens in a new tab)

Threat Intelligence

EPSS
2.86% (87th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-GPSDCLIENTS-17944193
  • published11 Jul 2026
  • disclosed9 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 9 Jul 2026

CVE-2026-58459  (opens in a new tab)
CWE-78  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gpsd-clients package and not the gpsd-clients package as distributed by RHEL.

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.