CVE-2025-68619
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
Description
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.
INFO
Published Date :
Jan. 1, 2026, 7:15 p.m.
Last Modified :
Oct. 7, 2026, 11:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Signal K Server to version 2.19.0 or later.
- Validate package sources and versions installed.
- Restrict administrative access to the appstore interface.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-68619.
| URL | Resource |
|---|---|
| https://github.com/SignalK/signalk-server/releases/tag/v2.19.0 | Release Notes |
| https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh | Exploit Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-68619 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-68619
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-68619 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-68619 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 07, 2026
Action Type Old Value New Value Changed Translation Title: signalk-server de SignalK, Description: Signal K Server es una aplicación de servidor que se ejecuta en un concentrador central en un barco. Las versiones anteriores a la 2.19.0 de la interfaz de la appstore permiten a los administradores instalar paquetes npm a través de un endpoint de API REST. Si bien el endpoint valida que el nombre del paquete existe en el registro de npm como un plugin o webapp conocido, el parámetro de versión acepta especificadores de versión npm arbitrarios, incluyendo URLs. npm soporta la instalación de paquetes desde repositorios git, sintaxis abreviada de GitHub y URLs HTTP/HTTPS que apuntan a tarballs. Cuando npm instala un paquete, puede ejecutar automáticamente cualquier script 'postinstall' definido en 'package.json', lo que permite la ejecución de código arbitrario. La vulnerabilidad existe porque la sintaxis del especificador de versión de npm es extremadamente flexible, y el código de SignalK pasa el parámetro de versión directamente a npm sin sanitización. Un atacante con acceso de administrador puede instalar un paquete desde una fuente controlada por el atacante que contenga un script 'postinstall' malicioso. La versión 2.19.0 contiene un parche para el problema. Title: signalk-server de SignalK, Description: Signal K Server es una aplicación de servidor que se ejecuta en un concentrador central en un barco. Las versiones anteriores a la 2.19.0 de la interfaz de la appstore permiten a los administradores instalar paquetes npm a través de un endpoint de API REST. Si bien el endpoint valida que el nombre del paquete existe en el registro de npm como un plugin o webapp conocido, el parámetro de versión acepta especificadores de versión npm arbitrarios, incluyendo URLs. npm soporta la instalación de paquetes desde repositorios git, sintaxis abreviada de GitHub y URLs HTTP/HTTPS que apuntan a tarballs. Cuando npm instala un paquete, puede ejecutar automáticamente cualquier script 'postinstall' definido en 'package.json', lo que permite la ejecución de código arbitrario. La vulnerabilidad existe porque la sintaxis del especificador de versión de npm es extremadamente flexible, y el código de SignalK pasa el parámetro de versión directamente a npm sin sanitización. Un atacante con acceso de administrador puede instalar un paquete desde una fuente controlada por el atacante que contenga un script 'postinstall' malicioso. La versión 2.19.0 contiene un parche para el problema. -
CVE Translated by [email protected]
Oct. 01, 2026
Action Type Old Value New Value Added Translation Title: signalk-server de SignalK, Description: Signal K Server es una aplicación de servidor que se ejecuta en un concentrador central en un barco. Las versiones anteriores a la 2.19.0 de la interfaz de la appstore permiten a los administradores instalar paquetes npm a través de un endpoint de API REST. Si bien el endpoint valida que el nombre del paquete existe en el registro de npm como un plugin o webapp conocido, el parámetro de versión acepta especificadores de versión npm arbitrarios, incluyendo URLs. npm soporta la instalación de paquetes desde repositorios git, sintaxis abreviada de GitHub y URLs HTTP/HTTPS que apuntan a tarballs. Cuando npm instala un paquete, puede ejecutar automáticamente cualquier script 'postinstall' definido en 'package.json', lo que permite la ejecución de código arbitrario. La vulnerabilidad existe porque la sintaxis del especificador de versión de npm es extremadamente flexible, y el código de SignalK pasa el parámetro de versión directamente a npm sin sanitización. Un atacante con acceso de administrador puede instalar un paquete desde una fuente controlada por el atacante que contenga un script 'postinstall' malicioso. La versión 2.19.0 contiene un parche para el problema. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'SignalK', 'product': 'signalk-server', 'versions': [{'status': 'affected', 'version': '< 2.19.0'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-68619', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-01-02T19:00:33.258635Z'} -
Initial Analysis by [email protected]
Jan. 06, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:* versions up to (excluding) 2.19.0 *cpe:2.3:a:signalk:signal_k_server:2.19.0:beta1:*:*:*:*:*:* *cpe:2.3:a:signalk:signal_k_server:2.19.0:beta2:*:*:*:*:*:* *cpe:2.3:a:signalk:signal_k_server:2.19.0:beta3:*:*:*:*:*:* *cpe:2.3:a:signalk:signal_k_server:2.19.0:beta4:*:*:*:*:*:* Added Reference Type GitHub, Inc.: https://github.com/SignalK/signalk-server/releases/tag/v2.19.0 Types: Release Notes Added Reference Type GitHub, Inc.: https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh Types: Exploit, Vendor Advisory -
New CVE Received by [email protected]
Jan. 01, 2026
Action Type Old Value New Value Added Description Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-94 Added Reference https://github.com/SignalK/signalk-server/releases/tag/v2.19.0 Added Reference https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh