CVE-2026-23515: Signal K set-system-time plugin vulnerable to RCE - Command Injection

February 2, 2026 (updated February 3, 2026)

A Command Injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages.

References

github.com/SignalK/set-system-time/commit/75b11eae2de528bf89ede3fb1f7ed057ddbb4d24
github.com/SignalK/signalk-server
github.com/SignalK/signalk-server/security/advisories/GHSA-p8gp-2w28-mhwg
github.com/advisories/GHSA-p8gp-2w28-mhwg
nvd.nist.gov/vuln/detail/CVE-2026-23515

Code Behaviors & Features

Detect and mitigate CVE-2026-23515 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →