An attacker who can authenticate with the Signal K Server as a low‑privileged user can bypass prototype boundary filtering via the "from" field. This allows the user to read internal functions and properties from the global prototype object, exposing more data than intended. The vulnerability is a classic arbitrary prototype read (CWE‑125) and violates data isolation.

Signal K Server versions prior to 2.24.0 are affected. The vulnerability applies to all builds of the server for which the "from" field processing is implemented without proper prototype checks.

The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because the attack requires authentication, the potential impact is limited to users already granted access, but the data read could reveal sensitive internal state. Until the patch is applied, the threat remains low but present.