GPSD Code Injection Vulnerability in gpsprof (CVE-2026-60122)

A significant code injection vulnerability, identified as CVE-2026-60122, has been discovered in the gpsprof utility within the gpsd project, affecting versions up to 3.27.5. This flaw enables a malicious actor, capable of controlling the input GPS data, to execute arbitrary operating system commands. The vulnerability stems from gpsprof unsafely incorporating attacker-controlled content into a gnuplot heredoc data block. Specifically, by injecting the string "EOD" into the SKY.satellites[].used field, attackers can prematurely terminate the heredoc and append gnuplot system() calls. These injected commands are then executed by gnuplot when it processes the generated plot script in polar mode, running with the privileges of the user who initiated gpsprof. This could lead to full system compromise or data exfiltration on affected Linux and macOS systems.

Attack Chain

1. An attacker prepares malicious GPS input data.
2. The attacker injects specific malicious content into the SKY.satellites[].used field of the GPS input data.
3. The injected content includes the string "EOD" to prematurely terminate a gnuplot heredoc block.
4. The attacker appends gnuplot system() calls containing desired OS commands immediately after the "EOD" string.
5. A legitimate user executes the gpsprof utility to process the attacker-controlled GPS input data.
6. gpsprof generates a gnuplot script, incorporating the unsanitized malicious content and system() calls into it.
7. gpsprof invokes gnuplot to execute the generated script in polar mode.
8. gnuplot processes the script, encounters the system() calls, and executes the arbitrary OS commands with the privileges of the user running gpsprof.

Impact

Successful exploitation of CVE-2026-60122 allows for arbitrary OS command execution on the system where gpsprof is run. This grants the attacker the ability to take control of the affected system, potentially leading to unauthorized data access, modification, or deletion, installation of further malicious software, or lateral movement within the network. The impact is direct system compromise as the user running the gpsprof utility. While no specific victim counts are available, any system running the vulnerable versions of gpsd with gpsprof exposed to untrusted GPS data is at risk.

Recommendation

• Patch CVE-2026-60122 immediately by upgrading gpsd to a version beyond 3.27.5 or applying commit 4c06658.
• Deploy the Sigma rule "Detect Gnuplot Spawning Suspicious Child Processes" to your SIEM to identify gnuplot initiating unexpected shell processes, which is a strong indicator of exploitation.
• Enable process creation logging for gnuplot and gpsprof on Linux and macOS systems to ensure the detection rule has the necessary telemetry.
• Review execution logs for gpsprof and gnuplot processes for any unusual arguments or child processes.