CVE-2026-23515

CVE-2026-23515 is a command injection vulnerability in Signal K Server versions prior to 1.5.0, allowing authenticated users with write permissions to execute arbitrary shell commands. If security is disabled, unauthenticated users can also exploit this flaw. The vulnerability stems from unsafe shell command construction when processing navigation.datetime values from WebSocket delta messages. With a CVSS score of 8.8 (High), this network-based attack is low complexity and can lead to full compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.