# CVE-2026-58459: ntpsec gpsd command injection in gpsprof via gnuplot title

Source: https://junglewise.ai/threats/cve-2026-58459-ntpsec-gpsd-command-injection-in-gpsprof-via-gnuplot-title  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-58459 · Severity: high · CVSS 7.8 · Published 2026-07-09

A vulnerability exists in gpsd, a service used to manage GPS and other location sensors. The 'gpsprof' tool, which generates visual plots of GPS data, fails to properly clean device information before passing it to the gnuplot graphing software. If a user is tricked into processing a malicious GPS log or connecting to a compromised GPS device, an attacker could execute arbitrary commands on the user's computer, potentially leading to full system compromise or data theft.

Technologies: [Gpsd Project Gpsd](https://junglewise.ai/threats/technologies/gpsd). Vendors: [Gpsd Project](https://junglewise.ai/threats/vendors/gpsd-project).

## Quick answers

**Is CVE-2026-58459 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58459 being exploited in the wild.

**How severe is CVE-2026-58459?** High severity, with a CVSS score of 7.8, published 9 July 2026.

**Which products and versions are affected?** Gpsd Project Gpsd through 3.27.5.

**Is there a fix for CVE-2026-58459?** A patch was published on 2026-07-09: Fix confirmed in commit 4c06658 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58459 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-58459?** Check whether you run Gpsd Project Gpsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the gpsprof utility within gpsd through release 3.27.5. The root cause is the improper neutralization of special elements in the 'subtype' field, which is sourced from DEVICES JSON log entries or NMEA PGRMT sentences. When gpsprof generates a gnuplot script, it embeds this subtype into a 'set title' statement, escaping only double-quote characters but failing to escape backticks used for command substitution. An attacker can provide a crafted subtype containing backtick payloads (e.g., `id`) that execute arbitrary shell commands in the context of the user running gnuplot. The vulnerability was addressed in commit 4c06658 by implementing proper escaping for backticks and other special characters.

## Affected products

- ntpsec gpsd through 3.27.5

## Timeline

- 2026-06-27: disclosed: Vulnerability reported to vendor by VulnCheck
- 2026-07-09: advisory: NVD and VulnCheck advisory published
- 2026-07-09: patched: Fix confirmed in commit 4c06658

## References

- [https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf58aa940132e630870af061dc88537](https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf58aa940132e630870af061dc88537)
- [https://github.com/ntpsec/gpsd/commit/4c06658e988f4ced1a7a574ce082a22ef625df56](https://github.com/ntpsec/gpsd/commit/4c06658e988f4ced1a7a574ce082a22ef625df56)
- [https://github.com/ntpsec/gpsd/commit/5581ba196d826a984fbfaf792b7d58535f9911ce](https://github.com/ntpsec/gpsd/commit/5581ba196d826a984fbfaf792b7d58535f9911ce)
- [https://gitlab.com/gpsd/gpsd/-/work_items/404](https://gitlab.com/gpsd/gpsd/-/work_items/404)
- [https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-plot-title-subtype-field](https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-plot-title-subtype-field)

## Related threats

- [gpsd integer underflow in NAVCOM packet parsing](https://junglewise.ai/threats/cve-2025-67269-gpsd-integer-underflow-in-navcom-packet-parsing)
- [gpsd heap-based out-of-bounds write in NMEA2000 driver](https://junglewise.ai/threats/cve-2025-67268-gpsd-heap-based-out-of-bounds-write-in-nmea2000-driver)