Bug 2506581 (CVE-2026-60122)

Summary:	CVE-2026-60122 gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in gpsd. This code injection vulnerability in the `gpsprof` utility allows an attacker to execute arbitrary operating system (OS) commands. By controlling GPS input data, an attacker can inject malicious content into the `SKY.satellites[].used` field. This unsanitized input is then processed by `gnuplot`, enabling the attacker to run commands as the user executing `gpsprof`.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2513964, 2513965
Bug Blocks:

Description OSIDB Bzimport 2026-07-23 20:01:30 UTC

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.

Comment 3 errata-xmlrpc 2026-09-08 10:15:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:65162 https://access.redhat.com/errata/RHSA-2026:65162

Comment 4 errata-xmlrpc 2026-09-08 18:45:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:65606 https://access.redhat.com/errata/RHSA-2026:65606