{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/gpsd/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-60122"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["gpsd (\u003c= 3.27.5)"],"_cs_severities":["high"],"_cs_tags":["code-injection","command-injection","gpsd","gnuplot","linux","macos","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["gpsd project"],"content_html":"\u003cp\u003eA significant code injection vulnerability, identified as CVE-2026-60122, has been discovered in the \u003ccode\u003egpsprof\u003c/code\u003e utility within the \u003ccode\u003egpsd\u003c/code\u003e project, affecting versions up to 3.27.5. This flaw enables a malicious actor, capable of controlling the input GPS data, to execute arbitrary operating system commands. The vulnerability stems from \u003ccode\u003egpsprof\u003c/code\u003e unsafely incorporating attacker-controlled content into a \u003ccode\u003egnuplot\u003c/code\u003e heredoc data block. Specifically, by injecting the string \u0026quot;EOD\u0026quot; into the \u003ccode\u003eSKY.satellites[].used\u003c/code\u003e field, attackers can prematurely terminate the heredoc and append \u003ccode\u003egnuplot system()\u003c/code\u003e calls. These injected commands are then executed by \u003ccode\u003egnuplot\u003c/code\u003e when it processes the generated plot script in polar mode, running with the privileges of the user who initiated \u003ccode\u003egpsprof\u003c/code\u003e. This could lead to full system compromise or data exfiltration on affected Linux and macOS systems.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker prepares malicious GPS input data.\u003c/li\u003e\n\u003cli\u003eThe attacker injects specific malicious content into the \u003ccode\u003eSKY.satellites[].used\u003c/code\u003e field of the GPS input data.\u003c/li\u003e\n\u003cli\u003eThe injected content includes the string \u0026quot;EOD\u0026quot; to prematurely terminate a \u003ccode\u003egnuplot\u003c/code\u003e heredoc block.\u003c/li\u003e\n\u003cli\u003eThe attacker appends \u003ccode\u003egnuplot system()\u003c/code\u003e calls containing desired OS commands immediately after the \u0026quot;EOD\u0026quot; string.\u003c/li\u003e\n\u003cli\u003eA legitimate user executes the \u003ccode\u003egpsprof\u003c/code\u003e utility to process the attacker-controlled GPS input data.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003egpsprof\u003c/code\u003e generates a \u003ccode\u003egnuplot\u003c/code\u003e script, incorporating the unsanitized malicious content and \u003ccode\u003esystem()\u003c/code\u003e calls into it.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003egpsprof\u003c/code\u003e invokes \u003ccode\u003egnuplot\u003c/code\u003e to execute the generated script in polar mode.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003egnuplot\u003c/code\u003e processes the script, encounters the \u003ccode\u003esystem()\u003c/code\u003e calls, and executes the arbitrary OS commands with the privileges of the user running \u003ccode\u003egpsprof\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-60122 allows for arbitrary OS command execution on the system where \u003ccode\u003egpsprof\u003c/code\u003e is run. This grants the attacker the ability to take control of the affected system, potentially leading to unauthorized data access, modification, or deletion, installation of further malicious software, or lateral movement within the network. The impact is direct system compromise as the user running the \u003ccode\u003egpsprof\u003c/code\u003e utility. While no specific victim counts are available, any system running the vulnerable versions of \u003ccode\u003egpsd\u003c/code\u003e with \u003ccode\u003egpsprof\u003c/code\u003e exposed to untrusted GPS data is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-60122 immediately by upgrading \u003ccode\u003egpsd\u003c/code\u003e to a version beyond 3.27.5 or applying commit 4c06658.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Gnuplot Spawning Suspicious Child Processes\u0026quot; to your SIEM to identify \u003ccode\u003egnuplot\u003c/code\u003e initiating unexpected shell processes, which is a strong indicator of exploitation.\u003c/li\u003e\n\u003cli\u003eEnable process creation logging for \u003ccode\u003egnuplot\u003c/code\u003e and \u003ccode\u003egpsprof\u003c/code\u003e on Linux and macOS systems to ensure the detection rule has the necessary telemetry.\u003c/li\u003e\n\u003cli\u003eReview execution logs for \u003ccode\u003egpsprof\u003c/code\u003e and \u003ccode\u003egnuplot\u003c/code\u003e processes for any unusual arguments or child processes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T20:19:48Z","date_published":"2026-07-23T20:19:48Z","id":"https://feed.craftedsignal.io/briefs/2026-07-gpsd-code-injection/","summary":"A high-severity code injection vulnerability, CVE-2026-60122, exists in the gpsprof utility of gpsd through version 3.27.5, allowing an attacker to achieve arbitrary OS command execution by injecting malicious content into GPS input data processed by gnuplot.","title":"GPSD Code Injection Vulnerability in gpsprof (CVE-2026-60122)","url":"https://feed.craftedsignal.io/briefs/2026-07-gpsd-code-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Gpsd","version":"https://jsonfeed.org/version/1.1"}