Arbitrary Code Execution Vulnerability in Signal K Server Application

CVE-2025-68619

What is CVE-2025-68619?

The Signal K Server application, essential for central hub operations on boats, is susceptible to arbitrary code execution due to a vulnerability in its app store interface. In versions earlier than 2.19.0, admin interface allows npm packages installation via a REST API endpoint. Although it verifies the package name against the npm registry, the version parameter is inadequately validated, permitting attackers to specify arbitrary npm version formats, including URLs. This flexibility allows the installation of packages from potentially harmful sources, which can contain malicious scripts that execute automatically during the installation process. Affected users are urged to upgrade to version 2.19.0 or later, which addresses this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References