{
  "cveId": "CVE-2026-58459",
  "url": "https://patchblox.com/security/cve/CVE-2026-58459",
  "summary": "CVE-2026-58459 is fixed in 17 products on 1 platform, first by FEDORA-2026-D61FCB86ED, released July 13, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "gpsd: gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allo...",
  "description": "gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.",
  "published": "2026-07-09T16:14:02Z",
  "severity": "critical",
  "cvss": 9.6,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
  "epss": 0.02862,
  "epssPercentile": 0.86843,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "gpsd",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.25-5\u002Bdeb13u2",
      "fix": "DEBIAN-CVE-2026-58459",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-58459",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "gpsd",
      "release": "Debian 14",
      "fixedVersion": "3.27.5-1",
      "fix": "DEBIAN-CVE-2026-58459",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-58459",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "gpsd",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd",
      "release": "RHEL 10",
      "fixedVersion": "3.26.1-3.el10_2.1",
      "fix": "RHSA-2026:51075",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-51075",
      "released": "2026-08-07T15:24:03Z"
    },
    {
      "platform": "linux",
      "product": "gpsd",
      "release": "almalinux 10",
      "fixedVersion": "1:3.26.1-3.el10_2.1",
      "fix": "ALSA-2026:51075",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-51075",
      "released": "2026-08-06T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gpsd",
      "release": "ol 10",
      "fixedVersion": "1:3.26.1-3.0.1.el10_2.1",
      "fix": "ELSA-2026-51075",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-51075",
      "released": "2026-08-06T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gpsd",
      "release": "rocky 10",
      "fixedVersion": "1:3.26.1-3.el10_2.1",
      "fix": "RLSA-2026:51075",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-51075",
      "released": "2026-08-07T12:07:56Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-clients",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-clients",
      "release": "almalinux 10",
      "fixedVersion": "1:3.26.1-3.el10_2.1",
      "fix": "ALSA-2026:51075",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-51075",
      "released": "2026-08-06T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-clients",
      "release": "ol 10",
      "fixedVersion": "1:3.26.1-3.0.1.el10_2.1",
      "fix": "ELSA-2026-51075",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-51075",
      "released": "2026-08-06T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-clients-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-compat",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-debugsource",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-devel",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-libs",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-libs-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-minimal",
      "release": "RHEL 9",
      "fixedVersion": "1:3.26.1-2.el9_8.1",
      "fix": "RHSA-2026:51153",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-51153",
      "released": "2026-08-07T15:24:03Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-minimal",
      "release": "almalinux 9",
      "fixedVersion": "1:3.26.1-2.el9_8.1",
      "fix": "ALSA-2026:51153",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-51153",
      "released": "2026-08-06T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-minimal",
      "release": "ol 9",
      "fixedVersion": "1:3.26.1-2.0.1.el9_8.1",
      "fix": "ELSA-2026-51153",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-51153",
      "released": "2026-08-07T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-minimal",
      "release": "rocky 9",
      "fixedVersion": "1:3.26.1-2.el9_8.1",
      "fix": "RLSA-2026:51153",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-51153",
      "released": "2026-08-07T12:04:39Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-minimal-clients",
      "release": "RHEL 9",
      "fixedVersion": "1:3.26.1-2.el9_8.1",
      "fix": "RHSA-2026:51153",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-51153",
      "released": "2026-08-07T15:24:03Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-minimal-clients",
      "release": "almalinux 9",
      "fixedVersion": "1:3.26.1-2.el9_8.1",
      "fix": "ALSA-2026:51153",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-51153",
      "released": "2026-08-06T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-minimal-clients",
      "release": "ol 9",
      "fixedVersion": "1:3.26.1-2.0.1.el9_8.1",
      "fix": "ELSA-2026-51153",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-51153",
      "released": "2026-08-07T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-qt",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-qt-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-qt-devel",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "gpsd-xclients",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "python3-gpsd",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    },
    {
      "platform": "linux",
      "product": "python3-gpsd",
      "release": "almalinux 10",
      "fixedVersion": "1:3.26.1-3.el10_2.1",
      "fix": "ALSA-2026:51075",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-51075",
      "released": "2026-08-06T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-gpsd",
      "release": "ol 10",
      "fixedVersion": "1:3.26.1-3.0.1.el10_2.1",
      "fix": "ELSA-2026-51075",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-51075",
      "released": "2026-08-06T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-gpsd-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1:3.26.1-7.fc43",
      "fix": "FEDORA-2026-D61FCB86ED",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d61fcb86ed",
      "released": "2026-07-13T13:32:30Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}