Executive brief
A vulnerability in the gpsprof utility, part of the gpsd suite used for GPS data handling, allows an attacker to execute unauthorized commands on a user's computer. By providing a specially crafted GPS data file, an attacker can trick the software into running malicious code when a user attempts to generate a polar plot. This could lead to a full system compromise or data theft, depending on the permissions of the person running the tool.
Technical details
A code injection vulnerability exists in the `polarplot.data()` function of the `gpsprof` utility within gpsd. The root cause is the unsanitized insertion of the `SKY.satellites[].used` field into a gnuplot heredoc data block using a `%s` format string. An attacker can provide a crafted input containing the 'EOD' string to prematurely terminate the heredoc and append gnuplot `system()` calls. Exploitation occurs when a victim uses `gpsprof` to process a malicious JSON log file in polar mode and subsequently runs the generated script through gnuplot. The vulnerability is fixed in commit 4c06658 (and 5a9c44a) by enforcing boolean type checks on the affected field.
Affected products
- gpsd gpsd through 3.27.5
Timeline
- 2026-07-20: patched: Fix committed to repository
- 2026-07-23: disclosed: Vulnerability disclosed and CVE assigned