Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages. This vulnerability is fixed in 1.5.0.

Affected: npm: @signalk/set-system-time

### Summary A Command Injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing `navigation.datetime` values received via WebSocket delta messages.

### Details **Product:** Signal K set-system-time plugin **Repository:** https://github.com/SignalK/set-system-time

File: `index.js`, lines 60-71

```javascript stream.onValue(function (datetime) { var child if (process.platform == 'win32') { console.error("Set-system-time supports only linux-like os's") } else { if( ! plugin.useNetworkTime(options) ){ const useSudo = typeof options.sudo === 'undefined' || options.sudo const setDate = `date --iso-8601 -u -s "${datetime}"` // ← VULNERABLE const command = useSudo ? `if sudo -n date &> /dev/null ; then sudo ${setDate} ; else exit 3 ; fi` : setDate child = require('child_process').spawn('sh', ['-c', command]) // ← EXECUTES SHELL ```

The vulnerability has three components:

1. **Unsanitized Input**: The `datetime` value from `navigation.datetime` Signal K path is directly interpolated into a shell command without validation 2. **Shell Execution**: The command…