{"action":"Upgrade signalk-server to 2.19.0 or later.","affected":[{"fixed":"2.19.0","introduced":"0"}],"component":"signalk-server","cve_ids":["CVE-2025-66398"],"ecosystem":"npm","epss":0.1985,"exploited":false,"fixed_versions":["2.19.0"],"ghsa_id":"GHSA-w3x5-7c4c-66p9","id":"tcs_01M5KGDQN5RAP4YEJ07GXE3S0K","modified_at":"2026-02-03T03:14:47.787144Z","published_at":"2026-01-02T15:11:49Z","references":["https://osv.dev/vulnerability/GHSA-w3x5-7c4c-66p9","https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9","https://nvd.nist.gov/vuln/detail/CVE-2025-66398","https://github.com/SignalK/signalk-server/commit/5c211eaf33f0ccadbaed6720264780d92afbd7f8","https://github.com/SignalK/signalk-server","https://github.com/SignalK/signalk-server/releases/tag/v2.19.0"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-w3x5-7c4c-66p9","url":"https://osv.dev/vulnerability/GHSA-w3x5-7c4c-66p9"}],"summary":"Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)"}