CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Unauthenticated attackers can pollute server state to overwrite configuration files, leading to remote code execution and account takeover in Signal K Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-66398?
CVE-2025-66398 is a critical code injection vulnerability in signalk-server, published on 1 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.
Which versions are affected by CVE-2025-66398?
2 open source packages ship an affected version, including signalk-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
signalk-server npm | All versions | 2.19.0 |
signalk-server npm | All versions | 2.19.0 |
Products include Signalk Signal K Server.
How do I fix CVE-2025-66398?
Upgrade signalk-server to 2.19.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-66398 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66398 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in signalk-server
- CVE-2026-23515 RCE - Command Injection in Signal K set-system-time plugin
- CVE-2026-33950 signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity
- CVE-2025-68620 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
- CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
- CVE-2026-39320 Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Sources
Also known as GHSA-w3x5-7c4c-66p9.