CVE-2026-23515: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23515 is a critical OS command injection vulnerability in the Signal K Server's set-system-time plugin (@signalk/set-system-time) that allows authenticated users with write permissions — or unauthenticated users if server security is disabled — to execute arbitrary shell commands on the host system. It affects all versions of the plugin prior to 1.5.0 and was published on January 31, 2026, with NVD publication on February 2, 2026. The GitHub Advisory Database rates this vulnerability at CVSS v3.1 9.9 (Critical) with a changed scope, while NVD scores it at 8.8 (High) (GitHub Advisory, SignalK Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), specifically in index.js lines 60–71 of the set-system-time plugin. The navigation.datetime value received via WebSocket delta messages is directly interpolated into a shell command string — date --iso-8601 -u -s "${datetime}" — without any sanitization or format validation, and then executed via child_process.spawn('sh', ['-c', command]), which interprets shell metacharacters. If the server is configured with passwordless sudo for the date binary (as per official installation instructions), the injected command may execute with root privileges; otherwise, it runs with the privileges of the SignalK process user. A proof-of-concept Python script (poc.py) is publicly available that authenticates to the server and sends a crafted WebSocket delta message to create /tmp/signalk-RCE.txt as evidence of code execution (GitHub Advisory, SignalK Advisory).

Successful exploitation grants an attacker arbitrary command execution on the Signal K server host with the privileges of the SignalK process, or root-level access if passwordless sudo is misconfigured — enabling complete system compromise. All three security pillars are affected: confidentiality (access to all data on the host), integrity (ability to modify system files and configurations), and availability (ability to disrupt or destroy services). Because Signal K servers typically run as central hubs on marine vessels or IoT networks, compromise could extend to connected navigation systems and onboard infrastructure (GitHub Advisory, SignalK Advisory).

A public proof-of-concept exploit (poc.py) is available via the GitHub security advisory, requiring only valid read/write credentials and the set-system-time plugin to be enabled; no exploit is needed if server security is disabled entirely. The EPSS score from the GitHub Advisory Database is approximately 10.6% (93rd percentile), indicating elevated exploitation probability, though Feedly's data lists a lower EPSS of ~1.2%, reflecting differing scoring windows. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, SignalK Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Signal K Server instances (versions < 1.5.0) using Shodan, Censys, or local network scanning. Confirm the set-system-time plugin is installed and enabled.
2. Obtain credentials (if security enabled): Acquire valid Signal K user credentials with readwrite or admin permissions through phishing, credential stuffing, or default credential attempts. If server security is disabled, credentials are not required.
3. Authenticate to the server: Use the Signal K REST API or WebSocket interface to authenticate and obtain a session token.
4. Craft malicious WebSocket delta message: Construct a WebSocket delta message targeting the navigation.datetime Signal K path with an injected shell payload, e.g.:

   {"updates": [{"values": [{"path": "navigation.datetime", "value": "2024-01-01T00:00:00Z\"; touch /tmp/signalk-RCE.txt; echo \""}]}]}

5. Send the payload: Transmit the crafted delta message to the Signal K server's WebSocket endpoint. The set-system-time plugin processes the navigation.datetime value and interpolates it unsanitized into the shell command.
6. Achieve code execution: The shell interprets the injected metacharacters, executing the attacker's commands with the privileges of the SignalK process (or root if sudo is misconfigured). The PoC creates /tmp/signalk-RCE.txt to confirm execution; a real attacker could deploy a reverse shell or exfiltrate data.

   python3 poc.py --host <signalkserver_IP> -u <username> -p <password>

   (GitHub Advisory, SignalK Advisory)

• Network: Unexpected outbound connections from the Signal K server host to external IPs (reverse shell activity); unusual WebSocket delta messages to the Signal K server containing shell metacharacters (; | & $( )) in the navigation.datetime field.
• File System: Presence of unexpected files such as /tmp/signalk-RCE.txt or other artifacts in /tmp; new cron jobs, scripts, or binaries created by the SignalK process user or root; web shells placed in the Signal K installation directory.
• Logs: Signal K server logs showing navigation.datetime values that do not conform to ISO-8601 format (e.g., containing semicolons, pipes, or backticks); Node.js child process spawn events for unexpected commands (e.g., bash, curl, wget, python) originating from the SignalK process.
• Process: Unusual child processes spawned by the Signal K Node.js process (e.g., /bin/sh -c, curl, nc, python3) visible via ps aux or process monitoring tools; unexpected sudo invocations by the SignalK service account. (GitHub Advisory, SignalK Advisory)

The primary remediation is to upgrade the @signalk/set-system-time npm package to version 1.5.0 or later, which adds ISO-8601 format validation before shell interpolation (regex: /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z?$/) and rejects malformed input (Patch Commit). If immediate patching is not possible, disable the set-system-time plugin in the Signal K server configuration, ensure server security (authentication) is enabled to prevent unauthenticated access, and restrict write permissions to trusted users only. Additionally, review and restrict passwordless sudo configuration to limit the blast radius if exploitation occurs (GitHub Advisory, SignalK Advisory).

The vulnerability was reported by security researcher cchheang and published by Signal K maintainer tkurki on January 31, 2026. Coverage appeared on The Hacker Wire, which published both a vulnerability summary and a dedicated technical write-up titled "Signal K Server RCE via WebSocket Command Injection." The vulnerability was also referenced in a CISA weekly vulnerability bulletin (SB26-040) and noted by the security community on Twitter/X and Bluesky. No major vendor statements beyond the official GitHub advisory have been identified (GitHub Advisory).