CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-68619

Signal K RCE: How a Malicious npm Package Can Sink Your Boat

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 2, 2026·6 min read·33 visits

Executive Summary (TL;DR)

Authenticated administrators can achieve Remote Code Execution (RCE) on Signal K Server versions prior to 2.19.0. The vulnerability exists because the server passes unsanitized user input directly to `npm install`, allowing an attacker to specify a remote URL instead of a semantic version. This triggers the download of a malicious package and the immediate execution of its `postinstall` scripts.

Signal K Server, the open-source hub for marine data, contained a Remote Code Execution (RCE) vulnerability in its plugin management system. By failing to validate version strings passed to the npm installer, the server allowed authenticated administrators to trick the system into downloading and executing malicious packages from arbitrary URLs.

Official Patches

Signal KSignal K Server v2.19.0 Release Notes
GitHubPatch Commit

Fix Analysis (1)

Technical Appendix

CVSS Score
7.3/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Probability
0.07%
Top 100% most exploited

Affected Systems

Signal K Server < 2.19.0

Affected Versions Detail

Product
Affected Versions
Fixed Version
Signal K Server
Signal K
< 2.19.02.19.0
AttributeDetail
Attack VectorNetwork (Authenticated API)
ImpactRemote Code Execution (RCE)
CVSS v4.07.3 (High)
CWE IDCWE-94 (Improper Control of Generation of Code)
ComponentPlugin Management / npm wrapper
PrerequisitesAdmin Credentials

MITRE ATT&CK Mapping

T1203Exploitation for Client Execution
Execution
T1059Command and Scripting Interpreter
Execution
CWE-94
Improper Control of Generation of Code ('Code Injection')

The product allows user input to control or influence the generation of code that is then executed by the system.

Known Exploits & Detection

TheoreticalExploitation relies on standard npm functionality to install from remote URLs.

Vulnerability Timeline

Patch Commit Merged
2025-02-14
Version 2.19.0 Released
2025-02-14
CVE Published
2025-02-18

References & Sources

  • [1]GitHub Security Advisory
  • [2]NVD Detail

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•33 minutes ago•CVE-2026-54635
7.5

CVE-2026-54635: Authentication Bypass via Custom Webhook Paths in pytonapi

An authentication bypass vulnerability exists in the pytonapi library when custom paths are registered in the TonapiWebhookDispatcher. The application fails to retrieve or store secure tokens for custom paths, leading to a fail-open authorization check that allows unauthenticated remote attackers to send spoofed webhook events directly to internal handlers.

Amit Schendel
Amit Schendel
0 views•6 min read
•about 1 hour ago•CVE-2026-54588
9.6

CVE-2026-54588: Account Takeover via Host Header Injection in Poweradmin Authentication

Poweradmin is affected by a critical Host Header Injection vulnerability within its Single Sign-On (SSO) and logout authentication mechanisms. The application dynamically constructs external redirection and callback URLs using the client-controlled HTTP Host header. An unauthenticated attacker can exploit this behavior to poison OAuth and SAML callback parameters, redirecting authentication credentials directly to a malicious external server. This allows full administrative account takeover without credentials when a victim accesses a manipulated authentication link.

Amit Schendel
Amit Schendel
4 views•7 min read
•about 3 hours ago•GHSA-HC4M-Q9JH-XW4J
6.6

GHSA-hc4m-q9jh-xw4j: Registry Pack Verification Fail-Open Vulnerability in nono-cli

The nono-cli package verification mechanism fails open when both the lockfile entry and local trust bundle are absent. This allows local attackers to execute unverified package profiles and native host session hooks by removing metadata configurations, bypassing cryptographic integrity controls.

Alon Barad
Alon Barad
2 views•5 min read
•about 8 hours ago•CVE-2026-5326
5.3

CVE-2026-5326: Insecure Direct Object Reference (IDOR) in SourceCodester Leave Application System

An Insecure Direct Object Reference (IDOR) vulnerability exists in SourceCodester Leave Application System 1.0 within the User Information Handler component. The application processes client-supplied database identifiers via URL parameters without executing proper authorization checks or session validation. This allows remote, unauthenticated attackers to view sensitive administrative and employee records by altering the 'id' parameter.

Amit Schendel
Amit Schendel
6 views•5 min read
•3 days ago•GHSA-7PPR-R889-MCF2
7.5

GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service

An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.

Alon Barad
Alon Barad
7 views•5 min read
•3 days ago•GHSA-95CV-R8X4-VH75
7.6

GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler

A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.

Amit Schendel
Amit Schendel
10 views•7 min read