Description
gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ntpsec | gpsd | ≤ 3.27.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gpsd | 3.27.5-1 | — |
| Debian 13 | gpsd | 3.25-5+deb13u2 | — |
| Debian 12 | gpsd | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gpsd | No fix yet | — |
| Ubuntu 24.04 LTS | gpsd | No fix yet | — |
| Ubuntu 22.04 LTS | gpsd | No fix yet | — |
| Ubuntu 20.04 LTS | gpsd | No fix yet | — |
| Ubuntu 18.04 LTS | gpsd | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gpsd | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gpsd +2 | 1:3.26.1-3.el10_2.1 | RHSA-2026:51075 |
| RHEL 9 | gpsd-minimal +1 | 1:3.26.1-2.el9_8.1 | RHSA-2026:51153 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gpsd +2 | 1:3.26.1-3.el10_2.1 | ALSA-2026:51075 |
| AlmaLinux 9 | gpsd-minimal +1 | 1:3.26.1-2.el9_8.1 | ALSA-2026:51153 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gpsd | 1:3.26.1-3.el10_2.1 | RLSA-2026:51075 |
| Rocky Linux 9 | gpsd-minimal | 1:3.26.1-2.el9_8.1 | RLSA-2026:51153 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gpsd | 3.27.5-3.1 | openSUSE-SU-2026:11276-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gpsd +2 | 1:3.26.1-3.0.1.el10_2.1 | ELSA-2026-51075 |
| Oracle Linux 9 | gpsd-minimal +1 | 1:3.26.1-2.0.1.el9_8.1 | ELSA-2026-51153 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3.13-gpsd | No fix yet | — |
Advisories 10
- ALSA-2026:51153 Important: gpsd-minimal security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:51075 Important: gpsd security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2694 Red Hat Enterprise Linux (gpsd): Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Aug 17, 2026
- RLSA-2026:51075 Important: gpsd security update Rocky Linux Security Advisories · Aug 7, 2026
- RLSA-2026:51153 Important: gpsd-minimal security update Rocky Linux Security Advisories · Aug 7, 2026
- RHSA-2026:51075 Red Hat Security Advisory: gpsd security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2026:51153 Red Hat Security Advisory: gpsd-minimal security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- ELSA-2026-51153 Important: gpsd-minimal security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 7, 2026
- ELSA-2026-51075 Important: gpsd security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 6, 2026
- openSUSE-SU-2026:11276-1 gpsd-3.27.5-3.1 on GA media SUSE / openSUSE Security Updates · Jul 16, 2026
References
- https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267 issue-tracking
- Patch Commit (1) patch
- Patch Commit (2) patch
- Patch Commit (3) patch
- https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-plot-title-subtype-field third-party-advisory