CVE-2026-35038
signalk-server: Arbitrary Prototype Read via `from` Field Bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `from` field bypass. This vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should. This issue has been patched in version 2.24.0.
| CWE | CWE-20 CWE-125 CWE-200 |
| Vendor | signalk |
| Product | signalk-server |
| Published | Apr 2, 2026 |
| Last Updated | Apr 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for signalk signalk-server
Be the first to know when new unknown vulnerabilities affecting signalk signalk-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
SignalK / signalk-server
< 2.24.0