Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
Date: 2026-04
Affected: npm/signalk-server
Attack vector: rce
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-35038
CWE: CWE-125
CWE-20
CWE-200

## Summary The /signalk/v1/applicationData/... JSON-patch endpoint allows users to modify stored application data. To prevent Prototype Pollution, the developers implemented an isPrototypePollutionPath guard. However, this guard only checks the path property of incoming JSON-patch objects. It completely fails to check the from property. Because JSON-patch operations like copy and move extract data using the from property path, an attacker can construct a payload where from targets /__proto__/someProperty, completely evading the security check and successfully executing an Arbitrary Prototype Read. While this does not allow arbitrary code execution (as the destination path remains protected from __proto__), it does allow a user to exfiltrate internal Node functions and prototype state into their own application data. ## Vulnerability Root Cause File: src/interfaces/applicationData.js (Lines 48-57) ``` const DANGEROUS_PATH_SEGMENTS = ['__proto__', 'constructor', 'prototype'] function isPrototypePollutionPath(pathString) { const segments = pathString.split(/[./]/) return segments.some((seg) => DANGEROUS_PATH_SEGMENTS.includes(seg)) } function hasPrototypePollutionPatch(patches) { return patches.some( // [!VULNERABLE] Only checks patch.path, completely ignores patch.from (patch) => patch.path && isPrototypePollutionPath(patch.path) ) } ``` At Line 201: ``` if (hasPrototypePollutionPatch(req.body)) { res.status(400).send('invalid patch path') return }


Mitigations:

Architectural layers (MAESTRO):