CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-66398

Sinking the Ship: Signal K Server State Pollution to RCE

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·6 min read·31 visits

Executive Summary (TL;DR)

Signal K Server stored the path to a backup file in a global module variable. Unauthenticated attackers could upload a malicious backup, overwriting this variable. When a legitimate admin later triggered a restore, the server would use the attacker's file instead, leading to account takeover and eventual RCE via a separate command injection bug in the package manager.

A critical vulnerability in Signal K Server allows unauthenticated attackers to pollute a global variable used during backup restoration. By hijacking this shared state, an attacker can overwrite server configurations, gain administrative privileges, and chain a secondary command injection flaw to achieve full Remote Code Execution (RCE).

Official Patches

Signal KRelease notes for version 2.19.0 containing the fix

Fix Analysis (1)

Technical Appendix

CVSS Score
9.6/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

Signal K Server < 2.19.0

Affected Versions Detail

Product
Affected Versions
Fixed Version
Signal K Server
Signal K
< 2.19.02.19.0
AttributeDetail
CWE IDCWE-1329 (Reliance on Component State)
Secondary CWECWE-78 (OS Command Injection)
CVSS Score9.6 (Critical)
Attack VectorNetwork (Unauthenticated)
ImpactRemote Code Execution (RCE)
Exploit StatusPoC Available

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1098Account Manipulation
Persistence
T1059.004Command and Scripting Interpreter: Unix Shell
Execution
CWE-662
Improper Synchronization

Known Exploits & Detection

GitHub Security AdvisoryAdvisory detailing the state pollution and RCE chain

Vulnerability Timeline

Vulnerability patched in commit 5c211ea
2025-01-14
Version 2.19.0 released
2025-01-15
GitHub Advisory Published
2025-01-15

References & Sources

  • [1]GHSA-w3x5-7c4c-66p9: Remote Code Execution via Restore State Pollution

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 1 hour ago•GHSA-GM3R-Q2WP-HW87
8.7

GHSA-gm3r-q2wp-hw87: Quadratic-Time Denial of Service via Flag-Protection in Shescape

A high-severity algorithmic-complexity vulnerability in the Node.js library Shescape leads to a Quadratic-Time Denial of Service (DoS) when flag protection is enabled. By supplying inputs containing repetitive control characters and hyphens, remote attackers can trigger an inefficient nested loop in Shescape's argument-composition logic, blocking the Node.js single-threaded event loop and causing total application Denial of Service.

Amit Schendel
Amit Schendel
2 views•7 min read
•about 2 hours ago•GHSA-FP43-VJ7G-PG92
7.5

GHSA-FP43-VJ7G-PG92: Multi-Vector Security Vulnerabilities in OmniFaces JSF Utility Library

A multi-vector vulnerability advisory in the OmniFaces JavaServer Faces (JSF) utility library covers flaws leading to unauthenticated arbitrary file access, memory exhaustion (DoS), cross-site scripting (XSS), and WebSocket push channel hijacking.

Alon Barad
Alon Barad
5 views•5 min read
•about 3 hours ago•GHSA-FWJX-9P69-H25H
6.3

GHSA-FWJX-9P69-H25H: Terminal Escape Sequence Injection in Oh My Posh

Oh My Posh prior to version 29.35.1 is vulnerable to terminal escape sequence injection. Dynamic strings from directory names or Git repository metadata are written to the prompt output without neutralization, enabling unauthenticated remote code execution, clipboard hijacking, or terminal DoS when users navigate to malicious folders.

Amit Schendel
Amit Schendel
5 views•8 min read
•about 4 hours ago•GHSA-6XJ8-QV9J-XCJQ
7.8

GHSA-6XJ8-QV9J-XCJQ: Arbitrary Command Execution via Template Injection in Oh My Posh

A critical-severity template injection vulnerability in Oh My Posh allows for unauthenticated arbitrary command execution. This issue occurs when a user navigates their shell into a directory whose name contains malicious Go template syntax, which is subsequently parsed and executed by the prompt engine.

Amit Schendel
Amit Schendel
4 views•6 min read
•about 5 hours ago•GHSA-3R53-75J5-3G7J
5.6

GHSA-3r53-75j5-3g7j: Prototype Pollution in Quasar Framework extend Utility

A prototype pollution vulnerability (CWE-1321) in the Quasar framework's utility function 'extend' allows unauthenticated remote attackers to modify the global Object.prototype. This vulnerability can lead to application-level logic bypasses, denial of service, or potentially arbitrary code execution depending on downstream implementation.

Alon Barad
Alon Barad
8 views•6 min read
•about 6 hours ago•GHSA-HMJ8-5XMH-5573
7.5

GHSA-HMJ8-5XMH-5573: Connection Denial of Service via Oversized DATA Frame in py-libp2p

A critical connection-level Denial of Service (DoS) vulnerability exists in the Yamux stream multiplexer implementation of py-libp2p (versions <= 0.6.0). The flaw allows unauthenticated or authenticated peers to permanently stall a Yamux multiplexed connection by transmitting a single malformed 12-byte header claiming an oversized payload while withholding the payload bytes.

Amit Schendel
Amit Schendel
7 views•7 min read