gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d61fcb86ed advisory.

    Security fix for CVE-2026-58459


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-36e3aa0593 advisory.

    Security fix for CVE-2026-58459


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in     gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands     by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field     sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program     via a set title statement with only double-quote characters escaped, enabling arbitrary shell command     execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and     gnuplot workflow. (CVE-2026-58459)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
330527	Fedora 43 : gpsd (2026-d61fcb86ed)	Nessus	Fedora Local Security Checks	high
328433	Fedora 44 : gpsd (2026-36e3aa0593)	Nessus	Fedora Local Security Checks	high
326290	Linux Distros Unpatched Vulnerability : CVE-2026-58459	Nessus	Misc.	high

Detections

Analytics

CVE-2026-58459

high

Tenable Plugins

high

high

high