HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-58459 — gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injecti...

·Source: NIST NVD

Updated:

Executive Summary

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnup

Analysis

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow. CVSS Score: 7.8. Published: 2026-07-09T17:17:01.493.

Indicators of Compromise (1)

CVE (1)
CVE-2026-58459
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 9, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

How to Meet a 3-Day Remediation SLA & Comply with CISA BOD 26-04

Key Takeaways CISA BOD 26–04 mandates remediation of the publicly exposed, highest-risk, known-exploited vulnerabilities within 3 days. The directive applies a risk-based model evaluating exposure, KEV status, automation potential, and technical impact. Most high-risk vulnerability instances reside on non-critical endpoint assets, which are suited for automated patching at scale. Patchless remedia

Qualys Blog
MEDIUMVulnerability

Cryptohack Roundup: US SEC Eyes July Crypto Rule Proposal

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cryptohack-roundup-us-sec-eyes-july-crypto-rule-proposal-image_small-10-a-32183.jpg" align=right hspace=4><b>Also: Binance Eyes More Asia Licenses, India Pushes Fresh Crypto Curbs</b><br>This week, the U.S. Securities and Exchange Commission eyes July for a crypto rule proposal, Binance anticipates more Asian business, Malaysia se

Bank Info Security
MEDIUMVulnerability

WolfSSL, GeoVision, VTK vulnerabilities

Cisco Talos&#x2019; Vulnerability Discovery & Research team recently disclosed three vulnerabilities in WolfSSF, fourteen in GeoVision, and one vulnerability in VTK-DICOM. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco&#x2019;s third-party vulnerability disclosure policy .&#xA0; For

Cisco Talos