CVE-2026-58459

Name of the Vulnerable Software and Affected Versions gpsd versions prior to 3.27.6

Description A command injection issue exists in the gpsprof tool. Attackers who can control the GPS device subtype value can execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title. This occurs because the subtype field, sourced from a DEVICES JSON log entry or NMEA PGRMT sentence, is written into a generated gnuplot program via a set title statement where only double-quote characters are escaped. The execution happens as the user running gnuplot when the plot is rendered through the gpsprof and gnuplot workflow.

Recommendations Update to the version containing commit 4c06658 or newer.