Attack Chain

1. An attacker prepares malicious GPS input data.
2. The attacker injects specific malicious content into the SKY.satellites[].used field of the GPS input data.
3. The injected content includes the string "EOD" to prematurely terminate a gnuplot heredoc block.
4. The attacker appends gnuplot system() calls containing desired OS commands immediately after the "EOD" string.
5. A legitimate user executes the gpsprof utility to process the attacker-controlled GPS input data.
6. gpsprof generates a gnuplot script, incorporating the unsanitized malicious content and system() calls into it.
7. gpsprof invokes gnuplot to execute the generated script in polar mode.
8. gnuplot processes the script, encounters the system() calls, and executes the arbitrary OS commands with the privileges of the user running gpsprof.

Impact

Successful exploitation of CVE-2026-60122 allows for arbitrary OS command execution on the system where gpsprof is run. This grants the attacker the ability to take control of the affected system, potentially leading to unauthorized data access, modification, or deletion, installation of further malicious software, or lateral movement within the network. The impact is direct system compromise as the user running the gpsprof utility. While no specific victim counts are available, any system running the vulnerable versions of gpsd with gpsprof exposed to untrusted GPS data is at risk.

Recommendation

• Patch CVE-2026-60122 immediately by upgrading gpsd to a version beyond 3.27.5 or applying commit 4c06658.
• Deploy the Sigma rule "Detect Gnuplot Spawning Suspicious Child Processes" to your SIEM to identify gnuplot initiating unexpected shell processes, which is a strong indicator of exploitation.
• Enable process creation logging for gnuplot and gpsprof on Linux and macOS systems to ensure the detection rule has the necessary telemetry.
• Review execution logs for gpsprof and gnuplot processes for any unusual arguments or child processes.