Medium 4.2

Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

CVE-2026-115752 First seen on SecPulse Oct 23, 22:03

Affected packages

Ecosystem	Package	Affected	Fixed
SignalK	signalk-server	≥ 2.28.0-beta.2, < 2.34.0	2.34.0

Original description The description as published by the source.

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

advisory github.com
advisory github.com
advisory vulncheck.com
advisory nvd.nist.gov
advisory github.com
package github.com
patch github.com
web github.com

Key facts

CVSS v3: Medium 4.2; CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4: Low 2.3; CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Oct 23, 2026
First seen on SecPulse: Oct 23, 22:03
GHSA: GHSA-7wpf-ch8f-5f4x
CWE: CWE-918

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Server-Side Request Forgery

CWE

CWE-918

All

Signalk Signalk Server

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 25, 11:45
NIST National Vulnerability DatabaseOct 24, 04:57
GitHub Security Advisories (Global)Oct 24, 00:31
CVE.org (CVE Program・cvelistV5)Oct 23, 22:03