Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package

Description

The SignalK appstore interface allows administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs.

Recommendation

Update the signalk-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.9.0
• Patched version(s): 2.9.0

References

• GHSA-93jc-vqqc-vvvh
• CVE-2025-68619
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) - CVE-2025-66398
• Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding - CVE-2025-68272
• Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
• Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution - CVE-2023-36475

Tags:

npm

signalk-server