CVE-2026-23515
Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages. This vulnerability is fixed in 1.5.0.
How to fix
- signalk signal_k_server1.5.0 or later
- @signalk/set-system-time1.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| signalk signal_k_server | v < 1.5.0 | 1.5.0 |
| @signalk/set-system-timenpm | v < 1.5.0 | 1.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.