The gpsd software up to version 3.27.5 has an OS command injection vulnerability in the gpsprof tool. An attacker controlling the GPS device subtype value can inject shell commands via backtick characters embedded in the gnuplot plot title. This occurs because the subtype field, sourced from DEVICES JSON log entries or NMEA PGRMT sentences, is incorporated into a gnuplot script with insufficient escaping—only double quotes are escaped. When gpsprof renders the plot using gnuplot, the injected commands execute with the privileges of the user running gnuplot. The vulnerability was fixed in a commit identified as 4c06658 after version 3.27.5.

Successful exploitation allows an attacker with control over the GPS device subtype value to execute arbitrary shell commands on the affected system with the privileges of the user running gnuplot. This can lead to unauthorized code execution and potential system compromise. The vulnerability requires local access or the ability to influence GPS data inputs. There are no known exploits in the wild as of the published date.

A fix for this vulnerability is available in the commit 4c06658, which is after version 3.27.5. Users should upgrade gpsd to a version that includes this fix. Since no official patch version is explicitly stated, users must verify the vendor repository or release notes for the fixed version. Until patched, avoid processing untrusted GPS device subtype data with gpsprof and gnuplot to prevent command injection.