This is running inside a cgi

Excuse the slightly off-topic post, but I hope your $cmd variable isn't coming from user input. Or, if it is, I hope you're scrubbing it well. If not, you have opened yourself up to a major security hole. Fortunately, it's pretty easy to solve. Here's an adapted version of aquarium's solution:

    open(GNUPLOT, "-|", gnuplot => $cmd) or die;
    @output = <GNUPLOT>;
    close GNUPLOT or die "error reading GNUPLOT";
[download]

Since this uses the list form of open, the shell is never called. This eliminates the possibility of shell metacharacters being interpreted by your backtick command.