CVE-2026-60122 gpsd gpsprof Code Injection via SKY.satellites used Field
An attacker controlling GPS input can execute arbitrary OS commands via unsanitized data in gpsprof's gnuplot script generation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-60122?
CVE-2026-60122 is a high-severity code injection vulnerability in gpsd, published on 23 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.
Weakness: CWE-94
Which versions are affected by CVE-2026-60122?
Linux distribution packages (20)
gpsd AlmaLinux:10 | All versions | 1:3.26.1-3.el10_2.2 |
gpsd-clients AlmaLinux:10 | All versions | 1:3.26.1-3.el10_2.2 |
python3-gpsd AlmaLinux:10 | All versions | 1:3.26.1-3.el10_2.2 |
gpsd-minimal AlmaLinux:9 | All versions | 1:3.26.1-2.el9_8.2 |
gpsd-minimal-clients AlmaLinux:9 | All versions | 1:3.26.1-2.el9_8.2 |
gpsd Red Hat:enterprise_linux:10.2 | All versions | 1:3.26.1-3.el10_2.2 |
gpsd-clients Red Hat:enterprise_linux:10.2 | All versions | 1:3.26.1-3.el10_2.2 |
gpsd-clients-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 1:3.26.1-3.el10_2.2 |
gpsd-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 1:3.26.1-3.el10_2.2 |
gpsd-debugsource Red Hat:enterprise_linux:10.2 | All versions | 1:3.26.1-3.el10_2.2 |
python3-gpsd Red Hat:enterprise_linux:10.2 | All versions | 1:3.26.1-3.el10_2.2 |
python3-gpsd-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 1:3.26.1-3.el10_2.2 |
gpsd-minimal Red Hat:enterprise_linux:9::appstream | All versions | 1:3.26.1-2.el9_8.2 |
gpsd-minimal-clients Red Hat:enterprise_linux:9::appstream | All versions | 1:3.26.1-2.el9_8.2 |
gpsd-minimal-clients-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:3.26.1-2.el9_8.2 |
gpsd-minimal-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:3.26.1-2.el9_8.2 |
gpsd-minimal-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:3.26.1-2.el9_8.2 |
gpsd Rocky Linux:10 | All versions | 1:3.26.1-3.el10_2.2 |
gpsd-minimal Rocky Linux:9 | All versions | 1:3.26.1-2.el9_8.2 |
gpsd openSUSE:Tumbleweed | All versions | 3.27.5-4.1 |
How do I fix CVE-2026-60122?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-60122 being exploited?
There is no known exploitation of CVE-2026-60122 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:65162, ALSA-2026:65606, CLSA-2026-1789034846, CLSA-2026-1789389842, DEBIAN-CVE-2026-60122, GHSA-9m96-crvq-5qcj and 7 more.