CVE-2025-66398: Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Should you act?

High exploit likelihood

EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 19.9%, percentile 97: FIRST’s model estimates a 19.9% chance of exploitation activity in the next 30 days, higher than 97% of all scored CVEs (very high). EPSS is a probability, not a verdict.
• Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
• Only applies if your dependency tree includes signalk-server (npm) < 2.19.0, fixed in 2.19.0. Check your lockfile, including transitive dependencies.

What it is

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (restoreFilePath) of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., security.json, package.json), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.

From the GitHub advisory

Summary An unauthenticated attacker can pollute the internal state (restoreFilePath) of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., security.json, package.json), leading to account takeover and Remote Code Execution (RCE).

Details The vulnerability is caused by the use of a module-level global variable restoreFilePath in src/serverroutes.ts, which is shared across all requests.

Vulnerable Code Analysis: 1. Global State: restoreFilePath is defined at the top level of the module.

2. Unauthenticated State Pollution: The /skServer/validateBackup endpoint updates this variable. Crucially, this endpoint lacks authentication middleware, allowing any user to access it.

3. Restore Hijacking: The /skServer/restore endpoint uses the polluted restoreFilePath to perform the restoration.

Weakness type: CWE-78, CWE-913.

Product: signalk-server (npm) · Assigned by: GitHub_M · Published: 2026-01-01

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: required (a user must click/open something)
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 19.85% probability of exploitation activity in the next 30 days; percentile 97.

Timeline

• 2026-01-01 — CVE record published by GitHub_M
• 2026-01-02 — GitHub-reviewed advisory GHSA-w3x5-7c4c-66p9 published (critical)
• 2026-01-05 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-w3x5-7c4c-66p9 github.com
2. CVE.org record CVE-2025-66398 cve.org
3. NVD entry CVE-2025-66398 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com

Critical npm advisories · Today’s Security Digest