Threats Tagged 'ghsa-rjvc-ghm7-354c'

SignalK signalk-server versions from 2.28.0-beta.2 up to but not including 2.34.0 contain a server-side request forgery (SSRF) vulnerability. This flaw exists in the App Store icon fetcher component, which trusts absolute URLs for signalk.appIcon. An attacker can publish npm packages with Signal K keywords that cause the server to make requests to internal or cloud metadata endpoints. The responses, if image-typed, are then stored and served back via the admin UI. The vulnerability has a low CVSS 4.0 score of 2.3 and does not have known exploits in the wild.