PT-2026-1023 · Unknown+1 · Signal K Server+1

Published 2026-01-01 · Updated 2026-01-03 · CVE-2025-68619

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0

Description Signal K Server is a server application used in marine environments. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. The endpoint validates the package name against the npm registry, but the version parameter accepts arbitrary npm version specifiers, including URLs. npm's ability to install packages from various sources, such as git repositories and HTTP/HTTPS URLs, and execute postinstall scripts within package.json enables arbitrary code execution. The issue arises from the lack of sanitization of the version parameter before it is passed to npm. An attacker with administrative access can exploit this by installing a package from a malicious source containing a harmful postinstall script. The postinstall script is a section within the package.json file that defines commands to be executed after a package is installed.

Recommendations Versions prior to 2.19.0 should be updated to version 2.19.0 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-68619

GHSA-93JC-VQQC-VVVH

Affected Products

Signal K Server

Npm

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68619.json · Exploit
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68619 · Security Note
• https://osv.dev/vulnerability/GHSA-93jc-vqqc-vvvh · Vendor Advisory
• https://github.com/SignalK/signalk-server · Note
• https://github.com/SignalK/signalk-server/releases/tag/v2.19.0 · Note
• https://github.com/SignalK/signalk-server/commit/f06140bed702de93a5dbb6b33dc2486960764d1d · Note
• https://twitter.com/CVEnew/status/2006861491635429704 · Twitter Post
• https://t.me/cveNotify/147455 · Telegram Post
• https://twitter.com/pulsepatchio/status/2007464017393017232 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2006824676803182974 · Twitter Post
• https://t.me/CVEtracker/41193 · Telegram Post