gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1819:03 advisory.

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65606 advisory.

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65606 advisory.

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-656060 advisory.

    [3.26.1-2.0.1.el9_8.2]
    - Replaced upstream reference [Orabug: 35865525]

    [1:3.26.1-2.el9_8.2]
    - fix another command injection in gpsprof (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65162 advisory.

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65162 advisory.

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-651620 advisory.

    [3.26.1-3.0.1.el10_2.2]
    - Replace upstream reference [Orabug: 37033219]

    [1:3.26.1-3.el10_2.2]
    - fix another command injection in gpsprof (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65606 advisory.

    gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or     USB interface, making its data on the location/course/velocity of the sensor available to be queried on     TCP port 2947 of the host computer.  The Red Hat support for this package is limited. See     https://access.redhat.com/support/policy/gpsd-support for more details.

    Security Fix(es):

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65162 advisory.

    gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or     USB interface, making its data on the location/course/velocity of the sensor available to be queried on     TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and     war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds     to queries with a format that is substantially easier to parse than NMEA 0183.  The Red Hat support for     this package is limited. See https://access.redhat.com/support/policy/gpsd-support for more details.

    Security Fix(es):

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the     gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by     injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a     gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the     heredoc early and append gnuplot system() calls, achieving OS command execution as the user running     gpsprof when the generated plot script is processed by gnuplot in polar mode. (CVE-2026-60122)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
345657	MiracleLinux 9 : gpsd-minimal-3.26.1-2.el9_8.2 (AXSA:2026-1819:03)	Nessus	Miracle Linux Local Security Checks	Local	high
344506	AlmaLinux 9 : gpsd-minimal (ALSA-2026:65606)	Nessus	Alma Linux Local Security Checks	Local	high
344411	RockyLinux 9 : gpsd-minimal (RLSA-2026:65606)	Nessus	Rocky Linux Local Security Checks	Local	high
344328	Oracle Linux 9 : ELSA-2026-65606-0: / gpsd-minimal (ELSA-2026-656060)	Nessus	Oracle Linux Local Security Checks	Local	high
344052	RockyLinux 10 : gpsd (RLSA-2026:65162)	Nessus	Rocky Linux Local Security Checks	Local	high
344036	AlmaLinux 10 : gpsd (ALSA-2026:65162)	Nessus	Alma Linux Local Security Checks	Local	high
343908	Oracle Linux 10 : ELSA-2026-65162-0: / gpsd (ELSA-2026-651620)	Nessus	Oracle Linux Local Security Checks	Local	high
343890	RHEL 9 : gpsd-minimal (RHSA-2026:65606)	Nessus	Red Hat Local Security Checks	Local	high
343856	RHEL 10 : gpsd (RHSA-2026:65162)	Nessus	Red Hat Local Security Checks	Local	high
329614	Linux Distros Unpatched Vulnerability : CVE-2026-60122	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-60122

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high