Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-78gy-rewn-v7cf
Vulnerability ID VCID-78gy-rewn-v7cf
Aliases CVE-2025-68619
GHSA-93jc-vqqc-vvvh
Summary Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00059 https://api.first.org/data/v1/epss?cve=CVE-2025-68619
epss 0.00059 https://api.first.org/data/v1/epss?cve=CVE-2025-68619
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-93jc-vqqc-vvvh
cvssv3.1 7.2 https://github.com/SignalK/signalk-server
cvssv4 7.3 https://github.com/SignalK/signalk-server
generic_textual HIGH https://github.com/SignalK/signalk-server
cvssv3.1 7.2 https://github.com/SignalK/signalk-server/commit/f06140bed702de93a5dbb6b33dc2486960764d1d
cvssv4 7.3 https://github.com/SignalK/signalk-server/commit/f06140bed702de93a5dbb6b33dc2486960764d1d
generic_textual HIGH https://github.com/SignalK/signalk-server/commit/f06140bed702de93a5dbb6b33dc2486960764d1d
cvssv3.1 7.2 https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
cvssv4 7.3 https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
generic_textual HIGH https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
ssvc Track* https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
cvssv3.1 7.2 https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh
cvssv3.1_qr HIGH https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh
cvssv4 7.3 https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh
generic_textual HIGH https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh
ssvc Track* https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2025-68619
cvssv4 7.3 https://nvd.nist.gov/vuln/detail/CVE-2025-68619
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-68619
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-68619
https://github.com/SignalK/signalk-server
https://github.com/SignalK/signalk-server/commit/f06140bed702de93a5dbb6b33dc2486960764d1d
CVE-2025-68619 https://nvd.nist.gov/vuln/detail/CVE-2025-68619
GHSA-93jc-vqqc-vvvh https://github.com/advisories/GHSA-93jc-vqqc-vvvh
GHSA-93jc-vqqc-vvvh https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh
v2.19.0 https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/SignalK/signalk-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/SignalK/signalk-server
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/SignalK/signalk-server/commit/f06140bed702de93a5dbb6b33dc2486960764d1d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/SignalK/signalk-server/commit/f06140bed702de93a5dbb6b33dc2486960764d1d
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-01-02T19:00:33Z/ Found at https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-01-02T19:00:33Z/ Found at https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-68619
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2025-68619
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.18709
EPSS Score 0.00059
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:58:56.584304+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/68xxx/CVE-2025-68619.json 38.6.0