Executive brief
Signal K Server is a boat monitoring and control system that allows administrators to install plugins via a REST API. An attacker with admin credentials can exploit unsanitized version parameters to install packages from attacker-controlled sources, triggering automatic execution of malicious scripts. This enables complete system compromise and manipulation of critical nautical systems like autopilot and GPS on exposed vessels.
Technical details
The vulnerability is a code injection / unsanitized input flaw in the appstore REST API endpoint (src/interfaces/appstore.js and src/modules.ts). The endpoint validates that a package name exists in npm registry but does not sanitize the version parameter, which is directly concatenated into an npm install command. npm's flexible version specifier syntax allows URLs, git repositories, GitHub shorthands, and tarball references. When npm installs a package, it automatically executes postinstall scripts from package.json, enabling arbitrary command execution. Exploitation requires admin access to the Signal K Server, but the attack vector is network-accessible. An attacker can supply malicious version specifiers (e.g., github shorthand, git+https://, http tarball URLs) to install packages from attacker-controlled sources containing malicious postinstall scripts. Commands execute with Signal K process privileges, enabling data theft, system compromise, and manipulation of NMEA 2000/0183 maritime systems. The vulnerability is patched in version 2.19.0.
Affected products
- Signal K signalk-server <=2.19.0-beta.4
Timeline
- 2026-01-02: disclosed
- 2026-01-01: patched: Version 2.19.0 contains the fix