Signal K Server EUVD-2026-108960

Exploitation requires an attacker to publish an npm package using Signal K keywords so it is listed in the Signal K Server App Store, with that package's package.json declaring an absolute http(s) signalk.appIcon URL (the pre-fix code at icon-probe.js ~line 200 / icon-bytes.js ~line 138 pinned relative paths to the CDN but passed absolute URLs through as-is and followed redirects). The flaw is reachable only when a server operator actually browses the App Store (UI:P / passive interaction), which triggers the server-side fetch. Affected versions are 2.28.0-beta.2 up to but not including 2.34.0. Limiting factors that reduce realistic risk: the malicious package must successfully appear in the App Store listing, an admin must browse it, and only responses with an image/* content type are stored and returned - so retrievable data is constrained to content that can pass as an image. No special non-default configuration is required; default App Store browsing behavior is sufficient.

Multiple signals converge on this being a low-priority issue despite being a real, vendor-confirmed SSRF (CWE-918). The input CVSS 4.0 base score is 2.3 (Low) and the vulnerability intelligence Decision label is 'monitor' - not act_now or emergency. The vector (AV:N/AC:L/AT:P/PR:N/UI:P) shows network reach and no authentication on the target, but two dampening metrics matter: AT:P indicates a specific attack requirement beyond the attacker's direct control (a malicious npm package must actually be listed in the Signal K app store), and UI:P indicates a passive user action is needed (a server admin must browse the App Store to trigger the icon fetch). Impact is capped at VC:L/VI:L/VA:N with no scope change (SC:N/SI:N/SA:N): only image content-typed responses are stored and re-served, so exfiltration is limited to data that can masquerade as an image rather than arbitrary internal content. KEV status is NO (not listed by CISA) and no EPSS score is present in the input, so exploitation-probability data is MISSING and cannot be weighed. A reproduction is documented in the GitHub Security Advisory, but its author states the dist modules were driven directly rather than a full running server, so it is a PoC reference rather than a verified standalone working exploit. Net: a legitimate SSRF worth patching during normal cycles, but the reachability constraints (attacker must get a package listed AND an admin must browse it) and limited image-only impact make this a low real-world priority, not a high-urgency flaw.

An attacker publishes a malicious npm package carrying Signal K keywords so it appears in the Signal K Server App Store, declaring an absolute signalk.appIcon URL such as http://127.0.0.1/latest/meta-data/ or a vessel-network address. When a server operator browses the App Store, the server fetches that URL (following redirects) and stores any image/* response as the plugin icon, served back through the admin UI. A PoC reproduction is documented in the vendor advisory, though it was demonstrated by driving the dist modules directly rather than against a full running server.