CVE-2026-33951: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33951 is an unauthenticated source priorities manipulation vulnerability in Signal K Server, a marine navigation hub application. All versions of the signalk-server npm package prior to v2.24.0-beta.1 are affected. The vulnerability was published on April 2, 2026, with the patch released on March 23, 2026 (tagged v2.24.0-beta.1). It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, GitHub Security Advisory).

The root cause is classified as CWE-284 (Improper Access Control) and CWE-306 (Missing Authentication for Critical Function). The vulnerable code resides in src/serverroutes.ts (lines 1064–1076), where the PUT /signalk/v1/api/sourcePriorities endpoint (also accessible at /skServer/sourcePriorities) registers no authentication middleware, directly assigns the raw request body to app.config.settings.sourcePriorities, immediately activates the change via activateSourcePriorities(), and persists it to disk via writeSettingsFile(). No input validation, JSON schema enforcement, or field allowlisting is performed on the attacker-supplied body, making exploitation trivial from any network-reachable position (GitHub Security Advisory).

Successful exploitation allows a remote, unauthenticated attacker to manipulate which GPS, AIS, or other sensor data sources are trusted by the vessel's navigation system. Because changes are immediately applied and written to disk, the manipulation persists across server restarts, meaning a single attack can have lasting effects on navigation data integrity. In a maritime context, this could cause the vessel to rely on attacker-controlled or spoofed sensor data, posing serious safety risks. There is no confidentiality or availability impact, but the integrity impact on safety-critical navigation systems is significant (Github Advisory, GitHub Security Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Github Advisory). The vulnerability requires no authentication, no user interaction, and no special preconditions beyond network access to the Signal K Server HTTP port, making it trivially exploitable by any attacker who can reach the service. The EPSS score is approximately 0.108% (29th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify internet-facing or LAN-accessible Signal K Server instances (default HTTP port is typically 3000) using network scanners such as Nmap or Shodan, targeting versions prior to v2.24.0-beta.1.
2. Confirm endpoint availability: Send a GET or OPTIONS request to /signalk/v1/api/sourcePriorities to confirm the server is running and the endpoint is reachable without authentication.
3. Craft malicious payload: Construct a JSON body that reorders or replaces source priorities to favor an attacker-controlled or spoofed data source (e.g., a rogue GPS or AIS feed) over legitimate sensors.
4. Send unauthenticated PUT request: Issue a PUT /signalk/v1/api/sourcePriorities (or /skServer/sourcePriorities) HTTP request with the crafted JSON body and Content-Type: application/json header — no credentials or tokens are required.
5. Verify persistence: Confirm the change is applied immediately (the server responds with {"result": "ok"}) and survives a server restart, as the configuration is written to disk via writeSettingsFile() (GitHub Security Advisory).

• Network: Unexpected PUT requests to /signalk/v1/api/sourcePriorities or /skServer/sourcePriorities from unknown or external IP addresses in HTTP access logs.
• Logs: HTTP access log entries showing PUT /signalk/v1/api/sourcePriorities with a 200 OK response from an unauthenticated or unrecognized source; repeated or automated requests to this endpoint.
• File System: Unexpected modifications to the Signal K Server settings file (typically ~/.signalk/settings.json or equivalent) with altered sourcePriorities values and a recent modification timestamp not corresponding to legitimate administrative activity.
• Configuration: sourcePriorities in the server settings referencing unfamiliar or unexpected data source identifiers that do not match known onboard sensors (GitHub Security Advisory).

Upgrade Signal K Server to version v2.24.0-beta.1 or later, which patches the unauthenticated endpoint (GitHub Release). As an interim workaround, implement network-level access controls (e.g., firewall rules) to restrict access to the Signal K Server HTTP port to trusted hosts only, preventing unauthenticated external access to the API. Additionally, consider placing the server behind a reverse proxy that enforces authentication for all API endpoints.