Is CVE-2025-68619 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-68619 being exploited in the wild.

How severe is CVE-2025-68619?

High severity, with a CVSS score of 7.2, published 1 January 2026.

Which products and versions are affected?

signalk-server (npm) SEMVER:introduced=0,fixed=2.9.0.

Is there a fix for CVE-2025-68619?

Yes. signalk-server (npm): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-68619 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-68619?

Check whether you run signalk-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68619: Signal K Server remote code execution via malicious npm package installation

CVE-2025-68619 · Severity: high · CVSS 7.2 · Published 2026-01-01

Signal K Server is a boat monitoring and control system that allows administrators to install plugins via a REST API. An attacker with admin credentials can exploit unsanitized version parameters to install packages from attacker-controlled sources, triggering automatic execution of malicious scripts. This enables complete system compromise and manipulation of critical nautical systems like autopilot and GPS on exposed vessels.

Technologies: signalk-server (npm). Vendors: npm.

Quick answers

Is CVE-2025-68619 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-68619 being exploited in the wild.
How severe is CVE-2025-68619?: High severity, with a CVSS score of 7.2, published 1 January 2026.
Which products and versions are affected?: signalk-server (npm) SEMVER:introduced=0,fixed=2.9.0.
Is there a fix for CVE-2025-68619?: Yes. signalk-server (npm): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68619 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-68619?: Check whether you run signalk-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

signalk-server (npm): upgrade to 2.9.0 or later
```
npm install signalk-server@2.9.0
```

Technical details

The vulnerability is a code injection / unsanitized input flaw in the appstore REST API endpoint (src/interfaces/appstore.js and src/modules.ts). The endpoint validates that a package name exists in npm registry but does not sanitize the version parameter, which is directly concatenated into an npm install command. npm's flexible version specifier syntax allows URLs, git repositories, GitHub shorthands, and tarball references. When npm installs a package, it automatically executes postinstall scripts from package.json, enabling arbitrary command execution. Exploitation requires admin access to the Signal K Server, but the attack vector is network-accessible. An attacker can supply malicious version specifiers (e.g., github shorthand, git+https://, http tarball URLs) to install packages from attacker-controlled sources containing malicious postinstall scripts. Commands execute with Signal K process privileges, enabling data theft, system compromise, and manipulation of NMEA 2000/0183 maritime systems. The vulnerability is patched in version 2.19.0.

Affected products

Signal K signalk-server <=2.19.0-beta.4

Identifiers

CVE-2025-68619
GHSA-93jc-vqqc-vvvh

Timeline

2026-01-02: disclosed
2026-01-01: patched: Version 2.19.0 contains the fix

References

https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.