Arbitrary Code Execution Vulnerability in Signal K Server Application
CVE-2025-68619

7.3HIGH

Key Information:

Vendor

Signalk

Status
Signalk-server
Vendor
CVE Published:
1 January 2026

What is CVE-2025-68619?

The Signal K Server application, essential for central hub operations on boats, is susceptible to arbitrary code execution due to a vulnerability in its app store interface. In versions earlier than 2.19.0, admin interface allows npm packages installation via a REST API endpoint. Although it verifies the package name against the npm registry, the version parameter is inadequately validated, permitting attackers to specify arbitrary npm version formats, including URLs. This flexibility allows the installation of packages from potentially harmful sources, which can contain malicious scripts that execute automatically during the installation process. Affected users are urged to upgrade to version 2.19.0 or later, which addresses this issue.

Affected Version(s)

signalk-server < 2.19.0

References

https://github.com/SignalK/signalk-server/security/adviso...
x_refsource_CONFIRM
https://github.com/SignalK/signalk-server/releases/tag/v2...
x_refsource_MISC

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.