HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-60122 — gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection ...

·Source: NIST NVD

Updated:

Executive Summary

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to t

Analysis

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode. CVSS Score: 7.8. Published: 2026-07-23T20:17:09.207.

Indicators of Compromise (1)

CVE (1)
CVE-2026-60122
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 23, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

FCA streamlines transaction reporting obligations

Transaction reporting requirements become smarter, simpler and more proportionate under new rules from the FCA.

Finextra
MEDIUMVulnerabilityNEW

Santander embeds eSim package within mobile app

Banco Santader customers in Spain can now purchase and activate mobile data for roaming abroad, directly in the bank's mobile app.

Finextra
MEDIUMVulnerability

Mastercard strengthens Asia Pacific leadership team

Mastercard today announced that Joyce Bo has joined the company as Executive Vice President, Core Payments, Asia Pacific.

Finextra