9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23515

CVE-2026-23515: RCE - Command Injection in Signal K set-system-time plugin

Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages. This vulnerability is fixed in 1.5.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23515

CVE-2026-23515:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@signalk/set-system-time	npm	< 1.5.0	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the provided vulnerability description and references, which pointed to a command injection vulnerability in the set-system-time plugin for Signal K. The key piece of information was the patch commit URL: https://github.com/SignalK/set-system-time/commit/75b11eae2de528bf89ede3fb1f7ed057ddbb4d24. Using the get_commit_infos tool, the changes in this commit were retrieved. The diff for index.js revealed that the patch added input validation using a regular expression for the datetime variable. This confirmed that the datetime variable was the source of the injection. The vulnerable code, which constructs a shell command using this variable and executes it via child_process.spawn, is located within an anonymous function passed as a callback to stream.onValue. This callback is defined inside the plugin.start function. Therefore, the most precise location of the vulnerability is this anonymous function, which would likely appear in a runtime profiler as (anonymous). The root cause is the failure to sanitize user-controllable input (datetime) before incorporating it into a shell command, a classic command injection flaw.

Vulnerable functions

(anonymous function)

index.js

The vulnerability exists in an anonymous callback function registered with `stream.onValue` within the `start` method of the plugin. This function receives a `datetime` string from a Signal K delta message and directly interpolates it into a shell command string. This command is then executed using `child_process.spawn('sh', ['-c', command])`. Because the `datetime` input is not sanitized, an attacker can inject arbitrary shell commands by crafting a malicious `datetime` string, leading to Remote Code Execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.