Critical Command Injection Vulnerability in gpsd Package
Summary
RLSA-2026:65162: Important: gpsd security update. Affects gpsd versions < 1:3.26.1-3.el10_2.2. Fixed in 1:3.26.1-3.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd is a service daemon that facilitates access to GPS sensors connected via serial or USB interfaces. It allows multiple GPS client applications to share access to GPS data without contention, providing a simpler data format than NMEA 0183. The package is supported by the Rocky Enterprise Software Foundation, but its support is limited, as detailed in their policy documentation.
Vulnerability Detail
The vulnerability identified as CVE-2026-60122 allows for arbitrary OS command execution through code injection in the gpsprof utility of the gpsd package. This can lead to unauthorized access and control over the host system, potentially compromising sensitive data and system integrity. The vulnerability arises from improper handling of user input, which can be exploited by an attacker to execute arbitrary commands on the system.
How To Fix
Minimum fixed version
1:3.26.1-3.el10_2.2
This is the first release that contains the fix.
sudo dnf update gpsdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to restrict access to the gpsd service or disable it until the package can be updated. This can be done by stopping the service with the command:
sudo systemctl stop gpsd'.
Conclusion
The gpsd package has a critical vulnerability that allows for arbitrary command execution, which poses significant risks to system security. It is essential to update to the patched version promptly and consider temporary workarounds to mitigate potential threats.
See every vulnerability recorded for gpsd →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized command execution, potentially compromising system security and data integrity.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, consider restricting access to the gpsd service or disabling it temporarily to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
