Critical Command Injection Vulnerability in gpsd Package
Summary
RLSA-2026:51075: Important: gpsd security update. Affects gpsd versions < 1:3.26.1-3.el10_2.1. Fixed in 1:3.26.1-3.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd is a service daemon that facilitates access to GPS sensors connected to host computers via serial or USB interfaces. It allows multiple GPS client applications to share access to GPS data without contention or data loss. The service responds to queries in a format that is easier to parse than the traditional NMEA 0183 format. However, the Rocky Enterprise Software Foundation's support for gpsd is limited, which may affect timely updates and security patches.
Vulnerability Detail
The vulnerability, identified as CVE-2026-58459, is a command injection flaw that arises from improper handling of GPS device subtypes. This vulnerability allows an attacker to execute arbitrary code on the host system by sending specially crafted input to the gpsd service. The potential ramifications include unauthorized access to system resources, data breaches, and complete system compromise, making it critical to address this issue promptly.
How To Fix
Minimum fixed version
1:3.26.1-3.el10_2.1
This is the first release that contains the fix.
sudo dnf update gpsdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to restrict access to the gpsd service by configuring firewall rules to limit connections to trusted IP addresses only. This can be done using the following command:
sudo firewall-cmd --add-rich-rule='rule family=ipv4 source address=<trusted_ip> accept' --permanent' followed by 'sudo firewall-cmd --reload'.
Conclusion
The gpsd package has a critical command injection vulnerability that could lead to severe security risks. It is essential to update the package to the latest patched version to mitigate these risks. Additionally, implementing temporary workarounds can help protect systems until the update is applied.
See every vulnerability recorded for gpsd →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized code execution, data breaches, and complete system compromise.
Yes, a patch is available in the form of an updated gpsd package version 1:3.26.1-3.el10_2.1.
If immediate updating is not possible, implement firewall rules to restrict access to the gpsd service as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
