CVE-2026-58459 is a high severity flaw (CVSS 7.8) in gpsd through release 3.27.5. The gpsprof tool writes the GPS device subtype into a gnuplot title without full escaping, so backtick content can run shell commands when a victim renders the plot. The fix is at commit 4c06658.
What's affected
- gpsd through release 3.27.5.
- Fixed in commit 4c06658. A numbered release containing it is not confirmed in the record, so check the project.
How to check if you're exposed
Run gpsd -V to read the version. Then check whether anyone uses gpsprof and gnuplot to render plots from logs or devices you do not control. If nobody does, exposure is low.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Update gpsd to a build that includes commit 4c06658.
- Do not render gpsprof output from untrusted logs.
- Run gnuplot as a low privilege user when you must.
- Check your distribution for a patched package.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
This is CWE-78 (OS Command Injection). Data from a device is placed into a generated script, and only double quotes were escaped. Backticks stayed live, so gnuplot passed the content to the shell. The vector is local with user interaction, so an attacker needs the victim to render the plot.
The CISA KEV flag is false.
The fix is a change to how the plot title is quoted, per the commit message about back ticks. If you build gpsd from source, take a revision that includes it. If you use a distribution package, ask your distribution when it will backport the change, since the record does not name a numbered release.
Quick check
Is a remote attack likely?
The record scores it as a local attack that needs user interaction.
Sources
Last reviewed: 19 October 2026.
