Bug 2498939

Summary: CVE-2026-58459 gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Marian Rehak <mrehak>
Component: gpsd-epelAssignee: Troy Dawson <tdawson>
Status: ASSIGNED --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: epel10CC: mlichvar, tdawson
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["5dd130ce-acb2-4d33-9004-861e6207ceaa"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2498575    

Description Marian Rehak 2026-07-10 08:22:51 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.
Comment 1 Troy Dawson 2026-07-13 13:52:11 UTC 
Waiting for release in RHEL 10 so I can build this for epel.