Description
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gpsd | gpsd | ≤ 3.27.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gpsd | 3.27.5-1 | — |
| Debian 13 | gpsd | 3.25-5+deb13u2 | — |
| Debian 12 | gpsd | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gpsd | No fix yet | — |
| Ubuntu 24.04 LTS | gpsd | No fix yet | — |
| Ubuntu 22.04 LTS | gpsd | No fix yet | — |
| Ubuntu 20.04 LTS | gpsd | No fix yet | — |
| Ubuntu 18.04 LTS | gpsd | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gpsd | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gpsd +2 | 1:3.26.1-3.el10_2.2 | RHSA-2026:65162 |
| RHEL 9 | gpsd-minimal +1 | 1:3.26.1-2.el9_8.2 | RHSA-2026:65606 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gpsd +2 | 1:3.26.1-3.el10_2.2 | ALSA-2026:65162 |
| AlmaLinux 9 | gpsd-minimal +1 | 1:3.26.1-2.el9_8.2 | ALSA-2026:65606 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gpsd | 1:3.26.1-3.el10_2.2 | RLSA-2026:65162 |
| Rocky Linux 9 | gpsd-minimal | 1:3.26.1-2.el9_8.2 | RLSA-2026:65606 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gpsd | 3.27.5-4.1 | openSUSE-SU-2026:11891-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3.13-gpsd | No fix yet | — |
Advisories 8
- WID-SEC-2026-3229 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:65606 Important: gpsd-minimal security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:65162 Important: gpsd security update AlmaLinux Security Advisories · Oct 29, 2026
- openSUSE-SU-2026:11891-1 gpsd-3.27.5-4.1 on GA media SUSE / openSUSE Security Updates · Sep 29, 2026
- RLSA-2026:65606 Important: gpsd-minimal security update Rocky Linux Security Advisories · Sep 9, 2026
- RLSA-2026:65162 Important: gpsd security update Rocky Linux Security Advisories · Sep 9, 2026
- RHSA-2026:65162 Red Hat Security Advisory: gpsd security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2026:65606 Red Hat Security Advisory: gpsd-minimal security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
References
- Issue Tracker issue-tracking
- Patch Commit patch
- https://www.vulncheck.com/advisories/gpsd-gpsprof-code-injection-via-sky-satellites-used-field third-party-advisory