Read the docs
TI-2026-42067 Aliases CVE-2026-58459GHSA-2hhc-4hqc-4mg8

gpsd gpsprof Command Injection via gnuplot plot title subtype field

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.

Summary

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02862 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NTPsecgpsdup to 3.27.5—No fix listedCNA
  • gpsd VendorNTPsec Affected up to 3.27.5 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gpsd_project:gpsd:*:*:*:*:*:*:*:*up to 3.27.5VulnerableGpsd Project
  • cpe:2.3:a:gpsd_project:gpsd:*:*:*:*:*:*:*:* Versions up to 3.27.5 Vulnerable ·Gpsd Project

Remediation

Red Hat 2 advisories

  • RHSA-2026:51153 Released 2026-08-06 · Red Hat rating Important
    gpsd-minimal security update
    • Red Hat Enterprise Linux AppStream (v. 9) gpsd-minimal-1:3.26.1-2.el9_8.1, gpsd-minimal-clients-1:3.26.1-2.el9_8.1
  • RHSA-2026:51075 Released 2026-08-06 · Red Hat rating Important
    gpsd security update
    • Red Hat Enterprise Linux AppStream (v. 10) gpsd-1:3.26.1-3.el10_2.1, gpsd-clients-1:3.26.1-3.el10_2.1, python3-gpsd-1:3.26.1-3.el10_2.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:51075
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:51153

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58459
  2. 2026-10-03 Alias added: GHSA-2hhc-4hqc-4mg8

References

Exploit 1

Patch 3

  • TI-2019-04513 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2019-04514 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0CRITICAL 9.1
  • TI-2019-04515 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2019-04512 An issue was discovered in NTPsec before 1.1.3. CVSS 3.0MEDIUM 6.5
  • TI-2026-78850 Out-of-bounds read in NTPsec ntpd NTS extension field parsing CVSS 3.1HIGH 7.5
  • TI-2026-78847 Reachable assertion in NTPsec lets remote attackers terminate ntpd CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences