gpsd's gpsprof utility contains a code injection flaw that allows an attacker who can control GPS input data to embed malicious content into the SKY.satellites[].used field. The unsanitized field is written verbatim into a gnuplot heredoc data block. If the attacker supplies the string EOD to terminate the heredoc early, they can append gnuplot system() calls and cause the gnuplot interpreter to run arbitrary OS commands. The executed commands run with the privileges of the user running gpsprof, potentially compromising the confidentiality, integrity, and availability of the host system. The underlying weakness is a classic "command injection" flaw (CWE-94).

The vulnerability exists in gpsd releases up through 3.27.5. Newer releases starting with 3.27.6 incorporate the fix in commit 4c06658, which sanitizes the SKY.satellites[].used field before it is written to the gnuplot script. The affected component is the gpsprof command-line tool that ships with the gpsd package. The flaw does not affect other gpsd utilities or core GPS server functionality.

The risk is amplified if gpsprof is run with elevated privileges or on a system that allows untrusted GPS data to be injected by an attacker. Given the severity of the CVSS 8.5 score and the low EPSS score, immediate application of the published fix or equivalent mitigation is recommended to prevent potential compromise. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been observed as a widely exploited condition. Nonetheless, the potential impact and the availability of a simple exploit make it a high-priority issue for systems that expose gpsprof or accept GPS data from untrusted sources.