CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-68619

Signal K RCE: How a Malicious npm Package Can Sink Your Boat

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 2, 2026·6 min read·32 visits

Executive Summary (TL;DR)

Authenticated administrators can achieve Remote Code Execution (RCE) on Signal K Server versions prior to 2.19.0. The vulnerability exists because the server passes unsanitized user input directly to `npm install`, allowing an attacker to specify a remote URL instead of a semantic version. This triggers the download of a malicious package and the immediate execution of its `postinstall` scripts.

Signal K Server, the open-source hub for marine data, contained a Remote Code Execution (RCE) vulnerability in its plugin management system. By failing to validate version strings passed to the npm installer, the server allowed authenticated administrators to trick the system into downloading and executing malicious packages from arbitrary URLs.

Official Patches

Signal KSignal K Server v2.19.0 Release Notes
GitHubPatch Commit

Fix Analysis (1)

Technical Appendix

CVSS Score
7.3/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Probability
0.07%
Top 100% most exploited

Affected Systems

Signal K Server < 2.19.0

Affected Versions Detail

Product
Affected Versions
Fixed Version
Signal K Server
Signal K
< 2.19.02.19.0
AttributeDetail
Attack VectorNetwork (Authenticated API)
ImpactRemote Code Execution (RCE)
CVSS v4.07.3 (High)
CWE IDCWE-94 (Improper Control of Generation of Code)
ComponentPlugin Management / npm wrapper
PrerequisitesAdmin Credentials

MITRE ATT&CK Mapping

T1203Exploitation for Client Execution
Execution
T1059Command and Scripting Interpreter
Execution
CWE-94
Improper Control of Generation of Code ('Code Injection')

The product allows user input to control or influence the generation of code that is then executed by the system.

Known Exploits & Detection

TheoreticalExploitation relies on standard npm functionality to install from remote URLs.

Vulnerability Timeline

Patch Commit Merged
2025-02-14
Version 2.19.0 Released
2025-02-14
CVE Published
2025-02-18

References & Sources

  • [1]GitHub Security Advisory
  • [2]NVD Detail

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 1 hour ago•CVE-2026-58426
9.6

CVE-2026-58426: Cryptographic Boundary-Shifting in Gitea Actions Artifacts

CVE-2026-58426 is a critical security vulnerability in Gitea Actions where improper signature serialization allows an authenticated attacker to execute a canonicalization (boundary-shifting) attack. By rewriting query parameters while keeping the signature intact, the attacker can bypass access control checks to read private workflow artifacts or modify concurrent task upload states.

Alon Barad
Alon Barad
3 views•6 min read
•about 2 hours ago•GHSA-2F96-G7MH-G2HX
8.8

GHSA-2F96-G7MH-G2HX: Command Injection Bypass in GitPython Options Validation

GitPython prior to version 3.1.51 contains a command injection vulnerability due to flaws in its option validation routine. By exploiting Git's native argument parser behavior, specifically long-option abbreviation resolution and short-option clustering, attackers can bypass the check_unsafe_options blocklist to execute arbitrary OS commands.

Amit Schendel
Amit Schendel
5 views•5 min read
•about 3 hours ago•CVE-2026-59879
8.7

CVE-2026-59879: Infinite Loop and Integer Overflow in Immutable.js List Sizing

CVE-2026-59879 describes a critical integer overflow vulnerability in the Immutable.js library when handling indices near 32-bit boundaries. An attacker can leverage this flaw to cause a denial of service via CPU thread lockup or process crashes, as well as data corruption through silent size truncation.

Amit Schendel
Amit Schendel
6 views•8 min read
•about 4 hours ago•CVE-2026-54291
8.2

CVE-2026-54291: Silent Channel-Binding Authentication Downgrade in PostgreSQL JDBC Driver (pgjdbc)

A critical security bypass and algorithm downgrade vulnerability in the PostgreSQL JDBC Driver (pgjdbc) allows Man-in-the-Middle (MITM) attackers to silently bypass channel binding requirements. When configured with `channelBinding=require`, the driver fails to assert that the negotiated SCRAM mechanism utilizes channel binding, allowing downgrade to plain SCRAM-SHA-256 when encountering unsupported server certificate signature algorithms (such as Ed25519 or Ed448).

Alon Barad
Alon Barad
6 views•7 min read
•about 5 hours ago•CVE-2026-56170
7.5

CVE-2026-56170: Remote Denial of Service via Resource Exhaustion in ASP.NET Core

CVE-2026-56170 is a high-severity Remote Denial of Service (DoS) vulnerability in Microsoft's ASP.NET Core framework. The vulnerability spans three separate resource-management vectors within the ASP.NET Core ecosystem, including SignalR Stateful Reconnect allocations, JSON Patch Type Confusion leading to stack exhaustion, and Kestrel HTTP/2 synchronization issues. An unauthenticated remote attacker can exploit these issues to cause process-terminating exceptions, rendering applications unavailable.

Amit Schendel
Amit Schendel
6 views•7 min read
•about 6 hours ago•GHSA-8WHX-365G-H9VV
2.3

GHSA-8whx-365g-h9vv: HTML5 Named Whitespace Bypass in Loofah allowed_uri? Validation

The Loofah Ruby gem version 2.25.0 and 2.25.1 contains an incomplete validation vulnerability in its public string-level utility Loofah::HTML5::Scrub.allowed_uri?. This helper fails to detect 'javascript:' URIs that are split by HTML5 named whitespace character references such as &Tab; and &NewLine;. Applications manually invoking this utility to validate links are vulnerable to stored Cross-Site Scripting (XSS), as browsers parse and remove these entities during rendering.

Alon Barad
Alon Barad
5 views•7 min read