Quick answers
- Is CVE-2026-60122 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-60122 being exploited in the wild.
- How severe is CVE-2026-60122?
- High severity, with a CVSS score of 7.8, published 23 July 2026.
- Which products and versions are affected?
- gpsd gpsd through 3.27.5.
- Is there a fix for CVE-2026-60122?
- A patch was published on 2026-07-20: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-60122 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-60122?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A code injection vulnerability exists in the `polarplot.data()` function of the `gpsprof` utility within gpsd. The root cause is the unsanitized insertion of the `SKY.satellites[].used` field into a gnuplot heredoc data block using a `%s` format string. An attacker can provide a crafted input containing the 'EOD' string to prematurely terminate the heredoc and append gnuplot `system()` calls. Exploitation occurs when a victim uses `gpsprof` to process a malicious JSON log file in polar mode and subsequently runs the generated script through gnuplot. The vulnerability is fixed in commit 4c06658 (and 5a9c44a) by enforcing boolean type checks on the affected field.
Affected products
- gpsd gpsd through 3.27.5
Timeline
- 2026-07-20: patched: Fix committed to repository
- 2026-07-23: disclosed: Vulnerability disclosed and CVE assigned