https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 09:27:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267139 EUVD-2026-267139 https://cve.radiocsirt.org/vuln/euvd-2026-267139 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23515 <p>Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages. This vulnerability is fixed in 1.5.0.</p> <p>Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages. This vulnerability is fixed in 1.5.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23515 https://cve.radiocsirt.org/vuln/ghsa-p8gp-2w28-mhwg <p><strong>Affected:</strong> npm: @signalk/set-system-time</p> <p>### Summary A Command Injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing `navigation.datetime` values received via WebSocket delta messages.</p> <p>### Details **Product:** Signal K set-system-time plugin **Repository:** https://github.com/SignalK/set-system-time</p> <p>File: `index.js`, lines 60-71</p> <p>```javascript stream.onValue(function (datetime) { var child if (process.platform == &#39;win32&#39;) { console.error(&#34;Set-system-time supports only linux-like os&#39;s&#34;) } else { if( ! plugin.useNetworkTime(options) ){ const useSudo = typeof options.sudo === &#39;undefined&#39; || options.sudo const setDate = `date --iso-8601 -u -s &#34;${datetime}&#34;` // ← VULNERABLE const command = useSudo ? `if sudo -n date &amp;&gt; /dev/null ; then sudo ${setDate} ; else exit 3 ; fi` : setDate child = require(&#39;child_process&#39;).spawn(&#39;sh&#39;, [&#39;-c&#39;, command]) // ← EXECUTES SHELL ```</p> <p>The vulnerability has three components:</p> <p>1. **Unsanitized Input**: The `datetime` value from `navigation.datetime` Signal K path is directly interpolated into a shell command without validation 2. **Shell Execution**: The command…</p> <p><strong>Affected:</strong> npm: @signalk/set-system-time</p> <p>### Summary A Command Injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing `navigation.datetime` values received via WebSocket delta messages.</p> <p>### Details **Product:** Signal K set-system-time plugin **Repository:** https://github.com/SignalK/set-system-time</p> <p>File: `index.js`, lines 60-71</p> <p>```javascript stream.onValue(function (datetime) { var child if (process.platform == &#39;win32&#39;) { console.error(&#34;Set-system-time supports only linux-like os&#39;s&#34;) } else { if( ! plugin.useNetworkTime(options) ){ const useSudo = typeof options.sudo === &#39;undefined&#39; || options.sudo const setDate = `date --iso-8601 -u -s &#34;${datetime}&#34;` // ← VULNERABLE const command = useSudo ? `if sudo -n date &amp;&gt; /dev/null ; then sudo ${setDate} ; else exit 3 ; fi` : setDate child = require(&#39;child_process&#39;).spawn(&#39;sh&#39;, [&#39;-c&#39;, command]) // ← EXECUTES SHELL ```</p> <p>The vulnerability has three components:</p> <p>1. **Unsanitized Input**: The `datetime` value from `navigation.datetime` Signal K path is directly interpolated into a shell command without validation 2. **Shell Execution**: The command…</p> https://cve.radiocsirt.org/vuln/ghsa-p8gp-2w28-mhwg