Is CVE-2026-23515 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23515 being exploited in the wild.

How severe is CVE-2026-23515?

Low severity, with a CVSS score of 3.1, published 2 February 2026.

Which products and versions are affected?

@signalk/set-system-time (npm) SEMVER:introduced=0,fixed=1.5.0; Signal K Set-System-Time 0 through 1.4.0.

Is there a fix for CVE-2026-23515?

Yes. @signalk/set-system-time (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23515 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23515?

Check whether you run @signalk/set-system-time (npm) or Signal K Set-System-Time at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23515: Signal K set-system-time plugin command injection RCE

CVE-2026-23515 · Severity: low · CVSS 3.1 · Published 2026-02-02

The Signal K set-system-time plugin is a component that allows Signal K servers to synchronize system time with network time sources. A command injection vulnerability in this plugin enables attackers with write permissions (or any user if security is disabled) to execute arbitrary shell commands on the server with the privileges of the Signal K process, potentially escalating to root if sudo is misconfigured. An attacker can achieve complete system compromise including data theft, system modification, and service disruption.

Vendors: npm, Signal K.

Quick answers

Is CVE-2026-23515 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23515 being exploited in the wild.
How severe is CVE-2026-23515?: Low severity, with a CVSS score of 3.1, published 2 February 2026.
Which products and versions are affected?: @signalk/set-system-time (npm) SEMVER:introduced=0,fixed=1.5.0; Signal K Set-System-Time 0 through 1.4.0.
Is there a fix for CVE-2026-23515?: Yes. @signalk/set-system-time (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23515 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23515?: Check whether you run @signalk/set-system-time (npm) or Signal K Set-System-Time at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@signalk/set-system-time (npm): upgrade to 1.5.0 or later
```
npm install @signalk/set-system-time@1.5.0
```

Technical details

The vulnerability is an OS command injection (CWE-78) in the set-system-time plugin's handling of navigation.datetime values received via WebSocket delta messages. The vulnerable code directly interpolates user-supplied datetime input into a shell command without validation, then executes it via child_process.spawn('sh', ['-c', command]). Attack requires network access to the Signal K server and either disabled security (no credentials needed) or valid user credentials with write permissions; if passwordless sudo is configured (as recommended in official instructions), attackers gain root privilege execution. The fix is available in version 1.5.0, which replaces shell-based execution with child_process.execFile() to prevent shell interpretation of attacker-controlled input.

Affected products

Signal K set-system-time 0 through 1.4.0

Identifiers

CVE-2026-23515
GHSA-p8gp-2w28-mhwg

Timeline

2026-02-02: disclosed: Advisory published (GHSA-p8gp-2w28-mhwg, CVE-2026-23515)
2026-01-31: patched: Fix available in version 1.5.0

References

https://github.com/SignalK/signalk-server/security/advisories/GHSA-p8gp-2w28-mhwg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.