CVE-2026-23515: RCE - Command Injection in Signal K set-system-time plugin

Summary A Command Injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages.

Details Product: Signal K set-system-time plugin Repository: https://github.com/SignalK/set-system-time

File: index.js, lines 60-71

javascript stream.onValue(function (datetime) { var child if (process.platform == 'win32') { console.error("Set-system-time supports only linux-like os's") } else { if( ! plugin.useNetworkTime(options) ){ const useSudo = typeof options.sudo === 'undefined' || options.sudo const setDate = date --iso-8601 -u -s "${datetime}" // ← VULNERABLE const command = useSudo ? if sudo -n date &> /dev/null ; then sudo ${setDate} ; else exit 3 ; fi : setDate child = require('childprocess').spawn('sh', ['-c', command]) // ← EXECUTES SHELL

The vulnerability has three components:

1. Unsanitized Input: The datetime value from navigation.datetime Signal K path is directly interpolated into a shell command without validation 2. Shell Execution: The command is executed via spawn('sh', ['-c', command]), which interprets shell metacharacters 3. Sudo Privileges: The plugin can execute with root privileges if sudo is misconfigured, instructions to limit passwordless sudo to the /bin/date binary helps mitigate this but RCE can still be achieved with the privileges of the user that installed it.

PoC Exploitation Requirements

- Signal K server with security enabled, if disabled credentials not required - Valid user credentials with readwrite or admin permissions - set-system-time plugin installed and enabled - Signal K server installed on a Linux OS - Passwordless sudo configured, official instructions will do this for the date command which is enough to satisfy the if condition

Python """ Run provided POC: python3 poc.py --host signalkserverIP -u username -p password

Payload: Creates /tmp/signalk-RCE.txt to prove code execution """

Impact An attacker that has write privileges either through security on the Signal K server being disabled or valid credentials with read/write permissions can execute arbitrary commands on the server with the privileges of the SignalK process or root if sudo is misconfigured. This enables complete system compromise.

Recommendations

- Replace shell-based execution with childprocess.execFile() so user-controlled input is passed as arguments rather than interpreted by a shell.

- Validate that navigation.datetime conforms to an expected ISO-8601 format to improve robustness.