SignalK signalk-server prior to version 2.24.0 includes an arbitrary prototype read vulnerability that can be triggered by a low‑privileged authenticated user when a `from` field value bypasses prototype boundary filtering. The attacker can read internal functions and properties from the global prototype object, violating data isolation and exposing data that should be protected. This information disclosure is classified as CWE‑200, whereas the underlying implementation flaw involves CWE‑125 and CWE‑20.

The vulnerable product is SignalK signalk-server. All installations running any version earlier than 2.24.0 are affected. The CVE reference points to the release notes for v2.24.0, which contains the fix.

The CVSS score of 2.1 indicates a low‑severity issue, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication to the server and a user who can specify a `from` field value, which is usually available to local users or remote users with authentication credentials. While the risk to confidentiality is limited to exposed internal properties, the presence of the flaw means that an attacker could read any data attached to prototype extensions that are not otherwise protected.