CVE-2026-35038CWE-125CWE-20CWE-200

signalk-server: Arbitrary Prototype Read via `from` Field Bypass

Low · published April 2, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `from` field bypass. This vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should. This issue has been patched in version 2.24.0.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00411 · 34.2th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-20 · Improper Input Validation; CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-04-02T16:20Z
EPSS history
Timeline
  • 02 APR 16:20Z
    signalk-server: Arbitrary Prototype Read via `from` Field Bypass
    cvelistv5