74 matches found
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher
Summary The app store icon code dist/appstore/icon-probe.js around line 200 and icon-bytes.js around line 138 resolves a plugin's declared signalk.appIcon. Relative paths are pinned to the CDN, but an absolute https URL is used as-is: the server fetches it, follows redirects, and stores any image...
npm: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher
npm: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher vulnerability discovered by ? in WordPress npm signalk-server versions = 2.28.0-beta.2, 2.34.0...
npm: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
npm: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution vulnerability discovered by ? in WordPress npm signalk-server versions = 2.0.0, 2.34.0...
current-impact (1.0.0), nmea-streamer (>=1.0.1, <=2.2.0) potentially affected by CVE-2026-55591 via signalk-server (1.46.3)
signalk-server NPM version 1.46.3 is affected by a known vulnerability. The following packages have a transitive dependency on signalk-server and may be impacted: - current-impact 1.0.0 - nmea-streamer =1.0.1, =2.2.0 Source cves: CVE-2026-55591 Source advisory: MEND:CVE-2026-55591...
Server-side Request Forgery (SSRF)
Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the makeRemoteRequest function. An attacker can access internal network resources, cloud metadata services, and arbitrary extern...
PT-2026-50825
Summary signalk-server versions up to and including 2.27.0 contain a Server-Side Request Forgery SSRF vulnerability in three administrative endpoints used for remote Signal K server connection management. The makeRemoteRequest function accepts attacker-controlled host, port, useTLS, and...
CVE-2026-55591
creationtimestamp| type| source ---|---|--- 2026-06-16 18:01:53+00:00| published-proof-of-concept| https://github.com/SignalK/signalk-server/security/advisories/GHSA-q59x-jc9f-gfqf...
current-impact (1.0.0), nmea-streamer (>=1.0.1, <=2.2.0) potentially affected by CVE-2026-41893 via signalk-server (1.46.3)
signalk-server NPM version 1.46.3 is affected by a known vulnerability. The following packages have a transitive dependency on signalk-server and may be impacted: - current-impact 1.0.0 - nmea-streamer =1.0.1, =2.2.0 Source cves: CVE-2026-41893 Source advisory: MEND:CVE-2026-41893...
CVE-2026-41893
Signal K Server’s WebSocket login path (via ws signalk/v1/stream) processes login attempts without rate limiting, enabling credential brute‑forcing at ~20 attempts/sec per WebSocket connection and bypassing HTTP rate limiting. Affected cve: CVE-2026-41893 concerns pre‑2.25.0 behavior. Technical d...
GHSA-7GCJ-PHFF-2884 Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Summary The SignalK server is vulnerable to an unauthenticated Regular Expression Denial of Service ReDoS attack within its WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the context parameter of a stream subscription, an attacker can force the server's...
Regular Expression Denial of Service (ReDoS)
Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the contextMatcher and pathMatcher functions. An attacker can cause the server to become unresponsive and exhaust CPU...
current-impact (1.0.0), nmea-streamer (>=1.0.1, <=2.2.0) potentially affected by CVE-2026-39320 via signalk-server (1.46.3)
signalk-server NPM version 1.46.3 is affected by a known vulnerability. The following packages have a transitive dependency on signalk-server and may be impacted: - current-impact 1.0.0 - nmea-streamer =1.0.1, =2.2.0 Source cves: CVE-2026-39320 Source advisory: MEND:CVE-2026-39320...
GHSA-CXJ8-GGF2-P57C Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow
Summary SignalK Server contains a code-level vulnerability in its OIDC login and logout handlers where the unvalidated HTTP Host header is used to construct the OAuth2 redirecturi. Because the redirectUri configuration is silently unset by default, an attacker spoof the Host header to steal OAuth...
Origin Validation Error
Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Origin Validation Error via the construction of the redirectUri and fullPostLogoutUri using an unvalidated Host header in the OIDC authentication and logout processe...
Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow
Summary SignalK Server contains a code-level vulnerability in its OIDC login and logout handlers where the unvalidated HTTP Host header is used to construct the OAuth2 redirecturi. Because the redirectUri configuration is silently unset by default, an attacker spoof the Host header to steal OAuth...
Missing Authentication for Critical Function
Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the PUT /signalk/v1/api/sourcePriorities endpoint, which lacks authentication and directly assigns user input to...
Signal K Server: Unauthenticated Source Priorities Manipulation
Summary The SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns...
EUVD-2026-18374
Signal K Server: Unauthenticated Source Priorities Manipulation...
Authentication Bypass Using an Alternate Path or Channel
Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the /skServer/enableSecurity endpoint. An attacker can gain unauthorized administrative privileges by...