Signal K Server versions 2.28.0‑beta.2 through 2.34.0 include a server‑side request forgery flaw in the App Store icon fetcher that trusts absolute URLs supplied in the appIcon field. An attacker who can publish an npm package containing Signal K keywords can cause servers to request internal loopback, vessel network, or cloud metadata endpoints and store the returned image‑typed responses, which are then served back via the admin UI. This allows the attacker to access otherwise protected internal resources and can lead to sensitive information disclosure.

The vulnerable product is Signal K Server 2.28.0‑beta.2 to 2.34.0 from the vendor SignalK. Patch releases beyond 2.34.0 contain the fix; older or beta releases remain affected.

The CVSS score of 2.3 indicates a low severity vulnerability. No EPSS value is available, and the issue is not listed in CISA KEV. The vulnerability requires the server to perform outbound HTTP requests triggered by an attacker-controlled appIcon URL, which is likely achieved by publishing a malicious npm package with relevant keywords. Once in place, the attacker can trigger internal requests and obtain data through the admin UI. The risk is limited to servers that have the App Store icon fetcher enabled and are exposed to the npm ecosystem.