Skip to content
OpenAdvisories

Package · npm

@signalk/resources-provider

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.8
    GHSA-4xm8-rg9h-jhq2

    Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

    ### Summary Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged user read, write and delete files outside the storage root. Reading <config>/security.json discloses the JWT signing secret, enabling admin…

    signalk-server @signalk/resources-provider npm