CVE-2026-60122 gpsd CVE debrief

Who should care

Users of gpsd, particularly those using gpsprof utility, should be aware of this vulnerability and take necessary actions to mitigate it. This includes applying patches or updates provided by the vendor, using compensating controls to monitor and restrict access to the gpsprof utility, and implementing input validation and sanitization for GPS input data. Security teams and vulnerability management teams should prioritize patching or mitigating this vulnerability, as it allows for arbitrary OS command execution.

Technical summary

The gpsd gpsprof utility is vulnerable to code injection via the SKY.satellites[].used field. An attacker who controls GPS input data can execute arbitrary OS commands by injecting malicious content into this field, which is inserted unsanitized into a gnuplot heredoc data block. This allows for OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode. The vulnerability is due to a lack of input validation and sanitization in the gpsprof utility.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it allows for arbitrary OS command execution.

Recommended defensive actions

• Apply patches or updates provided by the vendor
• Use compensating controls to monitor and restrict access to the gpsprof utility
• Implement input validation and sanitization for GPS input data
• Monitor for suspicious activity and exception tracking
• Review and update asset inventory to identify potentially affected systems
• Perform exposure review to determine potential impact on the organization
• Track exceptions and retest remediated assets to ensure vulnerability is fully resolved

Evidence notes

The CVE record was published on 2026-07-23T20:17:09.207Z and last modified on 2026-07-27T17:16:37.857Z. The NVD entry is currently being reviewed. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impact. Defenders should verify the vulnerability's presence in their environments and review official advisories for specific guidance. Additional information may be available through vendor security bulletins or public vulnerability databases.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.