Executive brief
The Signal K set-system-time plugin is a component that allows Signal K servers to synchronize system time with network time sources. A command injection vulnerability in this plugin enables attackers with write permissions (or any user if security is disabled) to execute arbitrary shell commands on the server with the privileges of the Signal K process, potentially escalating to root if sudo is misconfigured. An attacker can achieve complete system compromise including data theft, system modification, and service disruption.
Technical details
The vulnerability is an OS command injection (CWE-78) in the set-system-time plugin's handling of navigation.datetime values received via WebSocket delta messages. The vulnerable code directly interpolates user-supplied datetime input into a shell command without validation, then executes it via child_process.spawn('sh', ['-c', command]). Attack requires network access to the Signal K server and either disabled security (no credentials needed) or valid user credentials with write permissions; if passwordless sudo is configured (as recommended in official instructions), attackers gain root privilege execution. The fix is available in version 1.5.0, which replaces shell-based execution with child_process.execFile() to prevent shell interpretation of attacker-controlled input.
Affected products
- Signal K set-system-time 0 through 1.4.0
Timeline
- 2026-02-02: disclosed: Advisory published (GHSA-p8gp-2w28-mhwg, CVE-2026-23515)
- 2026-01-31: patched: Fix available in version 1.5.0