What is CVE-2026-60122?

CVE-2026-60122 is a high-severity vulnerability in Gpsd, classified under Code Injection. CVSS score: 7.8/10. Published 2026-07-23.

How severe is CVE-2026-60122?

High severity. CVSS v3 base score is 7.8 out of 10.

RCE in Gpsd

CVE-2026-60122

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into t…

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Gpsd — versions 0, 5a9c44a42136b9bb98d460a8a716e9fd344a8d93

Weakness classification (CWE)

CWE-94 — Code Injection

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-60122?: CVE-2026-60122 is a high-severity vulnerability in Gpsd, classified under Code Injection. CVSS score: 7.8/10. Published 2026-07-23.
How severe is CVE-2026-60122?: High severity. CVSS v3 base score is 7.8 out of 10.