{"answers":{"affected":"2 open source packages ship an affected version, including signalk-server. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68619 exists.","fix":"Upgrade signalk-server to 2.9.0 or later.","what":"CVE-2025-68619 is a high-severity code injection vulnerability in signalk-server, published on 1 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-68619 and fix it if it is affected.\n\nWhat it is: CVE-2025-68619 is a high-severity code injection vulnerability in signalk-server, published on 1 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68619 exists.\n\nAffected packages and fixed versions:\n- signalk-server (npm): affected all versions; fixed in 2.9.0\n- signalk-server (npm): affected all versions; fixed in 2.9.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-68619/ (Markdown: https://insights.sbomify.com/CVE-2025-68619/index.md)","id":"CVE-2025-68619","markdown":"https://insights.sbomify.com/CVE-2025-68619/index.md","name":"CVE-2025-68619","record":{"aliases":["GHSA-93jc-vqqc-vvvh"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Marine data server","requires_auth":"high_privilege","summary":"An admin can achieve remote code execution by installing a malicious npm package via the appstore interface due to unsanitized version parameters.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"signal_k_server","vendor":"signalk"}],"cvss":{"score":7.3,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","version":"4.0"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"description":"Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package","id":"CVE-2025-68619","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"code_injection","year":"2025"},"n_packages":2,"n_references":2,"next":{"headline":"Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling","id":"CVE-2025-68620"},"packages":[{"ecosystem":"npm","fixed":["2.9.0"],"introduced":["0"],"last_affected":[],"package":"signalk-server","purl":null,"source":"GHSA-93jc-vqqc-vvvh"},{"ecosystem":"npm","fixed":["2.9.0"],"introduced":["0"],"last_affected":[],"package":"signalk-server","purl":"pkg:npm/signalk-server","source":"GHSA-93jc-vqqc-vvvh"}],"prev":{"headline":"Magick's failure to limit the depth of SVG file reads caused a DoS attack.","id":"CVE-2025-68618"},"products":["signalk-server"],"published":"2026-01-01","related":[{"cvss_score":10,"headline":"RCE - Command Injection in Signal K set-system-time plugin","id":"CVE-2026-23515","kev_date_added":null,"published":"2026-02-02"},{"cvss_score":9.7,"headline":"Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)","id":"CVE-2025-66398","kev_date_added":null,"published":"2026-01-01"},{"cvss_score":9.4,"headline":"signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity","id":"CVE-2026-33950","kev_date_added":null,"published":"2026-04-02"},{"cvss_score":9.1,"headline":"Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling","id":"CVE-2025-68620","kev_date_added":null,"published":"2026-01-01"},{"cvss_score":8.7,"headline":"Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)","id":"CVE-2026-41893","kev_date_added":null,"published":"2026-05-09"},{"cvss_score":7.5,"headline":"Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths","id":"CVE-2026-39320","kev_date_added":null,"published":"2026-04-21"},{"cvss_score":7.5,"headline":"Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding","id":"CVE-2025-68272","kev_date_added":null,"published":"2026-01-01"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-01-02","vendors":["SignalK"]},"summary":"An admin can achieve remote code execution by installing a malicious npm package via the appstore interface due to unsanitized version parameters.","url":"https://insights.sbomify.com/CVE-2025-68619/"}