CVE-2025-68619: Signal K Server RCE Vulnerability

CVE-2025-68619 Overview

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs.

npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any postinstall script defined in package.json, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious postinstall script.

Critical Impact

Authenticated administrators can achieve arbitrary code execution on the Signal K Server host by exploiting unsanitized npm version specifiers to install malicious packages from attacker-controlled sources.

Affected Products

• SignalK Signal K Server versions prior to 2.19.0
• SignalK Signal K Server 2.19.0-beta1
• SignalK Signal K Server 2.19.0-beta2
• SignalK Signal K Server 2.19.0-beta3
• SignalK Signal K Server 2.19.0-beta4

Discovery Timeline

• January 1, 2026 - CVE-2025-68619 published to NVD
• January 6, 2026 - Last updated in NVD database

Technical Details for CVE-2025-68619

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Code Injection) and affects the appstore interface of Signal K Server. The core issue stems from the flexible nature of npm's version specifier syntax, which allows not only semantic version ranges but also URLs pointing to git repositories, GitHub repositories via shorthand notation, and direct HTTP/HTTPS tarball URLs.

When an administrator uses the REST API endpoint to install a plugin or webapp, the server validates that the package name exists in the npm registry. However, the version parameter undergoes no such validation or sanitization. An attacker with administrative privileges can specify a version parameter that points to an external, malicious package source.

Upon installation, npm automatically executes any postinstall lifecycle script defined in the package's package.json file. This behavior is by design in npm but becomes a security vulnerability when the package source can be controlled by an attacker.

Root Cause

The root cause is insufficient input validation on the version parameter passed to the npm installation command. The Signal K Server code directly passes user-supplied version specifiers to npm without sanitizing or restricting the allowed format. Since npm accepts URLs as valid version specifiers, this creates a code injection vector through malicious postinstall scripts.

Attack Vector

The attack requires network access and administrative privileges on the Signal K Server instance. An authenticated attacker with admin access can exploit the appstore REST API endpoint by crafting a request that specifies a legitimate plugin name but substitutes a malicious URL as the version parameter.

The malicious URL can point to a git repository or tarball containing a crafted package.json with a postinstall script. When npm processes the installation request, it fetches the package from the attacker-controlled source and executes the malicious postinstall script with the same privileges as the Signal K Server process.

This vulnerability chain allows an attacker to escalate from authenticated admin access to arbitrary code execution on the underlying server system, potentially compromising the entire vessel's navigation and monitoring infrastructure.

Detection Methods for CVE-2025-68619

Indicators of Compromise

• Unusual npm installation activity in Signal K Server logs with URL-based version specifiers
• Network connections to unexpected external git repositories or tarball hosting services during plugin installation
• Unexpected processes spawned as child processes of the Signal K Server
• Modifications to system files or presence of new files in unexpected locations following plugin installations

Detection Strategies

• Monitor REST API calls to the appstore endpoint for version parameters containing URLs, git references, or GitHub shorthand syntax
• Implement network monitoring to detect outbound connections to non-standard npm registry sources during installation operations
• Configure file integrity monitoring on the Signal K Server installation directory and system directories
• Review Signal K Server access logs for suspicious plugin installation attempts by admin accounts

Monitoring Recommendations

• Enable verbose logging for npm operations within the Signal K Server environment
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activity following code execution
• Implement network segmentation to restrict outbound connectivity from the Signal K Server host
• Configure alerting for any npm installations that reference external URLs rather than standard registry packages

How to Mitigate CVE-2025-68619

Immediate Actions Required

• Upgrade Signal K Server to version 2.19.0 or later immediately
• Audit admin account access and review recent plugin installation history for suspicious activity
• Restrict network egress from Signal K Server hosts to only necessary destinations
• Review system logs for any signs of compromise or unauthorized code execution

Patch Information

SignalK has released version 2.19.0 which contains a patch for this vulnerability. The patch implements proper validation and sanitization of the version parameter to prevent arbitrary URL-based package sources. Users should upgrade to this version or later to remediate the vulnerability.

For detailed patch information, see the GitHub Release v2.19.0 and the GitHub Security Advisory GHSA-93jc-vqqc-vvvh.

Workarounds

• Restrict administrative access to trusted personnel only and implement multi-factor authentication where possible
• Implement network-level controls to block outbound connections to git hosting services and arbitrary tarball sources from the Signal K Server host
• Consider placing the Signal K Server behind a reverse proxy with request inspection to filter malicious version specifiers
• Disable or restrict access to the appstore REST API endpoint if plugin installation is not actively required

# Example: Restrict outbound git and tarball access via iptables
# Block outbound HTTPS to common git hosting services (adjust as needed)
iptables -A OUTPUT -p tcp --dport 443 -d github.com -j DROP
iptables -A OUTPUT -p tcp --dport 443 -d gitlab.com -j DROP
iptables -A OUTPUT -p tcp --dport 443 -d bitbucket.org -j DROP

# Allow only npm registry access
iptables -A OUTPUT -p tcp --dport 443 -d registry.npmjs.org -j ACCEPT