Executive brief
Signal K Server is a central data hub used on boats to manage marine electronics and navigation data. A security flaw allows an authenticated user with low privileges to bypass security filters and access internal system data that should be isolated. This could lead to the exposure of sensitive internal server functions and configuration details, potentially aiding further attacks.
Technical details
Signal K Server prior to version 2.24.0 is vulnerable to an arbitrary prototype read due to improper input validation in the JSON-patch endpoint. The `hasPrototypePollutionPatch` guard in `src/interfaces/applicationData.js` only inspects the `path` property of incoming patches, failing to validate the `from` property used in 'copy' or 'move' operations. An authenticated attacker can exploit this by providing a path containing `__proto__` in the `from` field, allowing them to exfiltrate internal Node.js functions and prototype properties into their own application data. While this does not grant direct remote code execution, it violates data isolation boundaries. The issue is fixed in version 2.24.0 by ensuring both `path` and `from` fields are validated against dangerous segments.
Affected products
- SignalK signalk-server < 2.24.0
Timeline
- 2026-03-26: patched: Version 2.24.0 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD