Threats affecting pkg:github/sgoudelis/ground-station

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

CVE-2026-53451 is a critical path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to write arbitrary files outside the intended directory by exploiting improper pathname limitation in a Socket.IO command. This can lead to remote code execution with service privileges via crafted logging configuration files, and may cause persistent service crashes. The issue is fixed in version 0.4.13.

CVE-2026-53452 is a path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to read arbitrary files outside the intended directory by exploiting improper validation of a pathname used in SDR configuration commands. The vulnerability requires the presence of readable JSON metadata files and associated data files to disclose contents. This issue is fixed in version 0.4.13.

Ground Station versions prior to 0.6.0 contain an unauthenticated blind server-side request forgery (SSRF) vulnerability. This flaw allows any unauthenticated Socket.IO client to cause the server to issue outbound HTTP requests to attacker-controlled destinations. The vulnerability arises from disabled authentication enforcement, a wildcard CORS policy, and lack of validation on URLs stored and used in scheduled sync tasks. The malicious URL persists in the database and triggers repeated SSRF every 24 hours without requiring attacker presence.

Ground Station versions prior to 0.6.0 have a high-severity unauthenticated denial-of-service vulnerability in the Socket.IO server. This flaw allows any unauthenticated network peer to send a restart_service command via the service_control event, forcibly terminating the ground-station process. The vulnerability arises from disabled authentication enforcement and a wildcard CORS policy on port 7000, enabling attackers to disrupt satellite-tracking sessions and related services. Repeated exploitation in Docker deployments can cause persistent denial-of-service conditions.