CVE-2026-35038
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.
Risk Assessment
The organization is at risk of internal data leakage and data isolation violation, potentially allowing users to access information they should not.
Recommendation
Update Signal K Server to version 2.24.0 or later, which includes the fix.
Original NVD description (English source)
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `from` field bypass. This vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should. This issue has been patched in version 2.24.0.