5vulnerabilities
- Critical1 (20.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate3 (60.0%)
- Low1 (20.0%)
magicmirror
Ecosystem: npm
Downloads: 519
- 1CriticalAffects 1 version
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 3ModerateAffects 3 versions
- 1LowAffects 1 version
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 4 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 3
- Low: 1
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (5)
Known vulnerabilities affecting magicmirror, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-998g-7v5w-cr7g | Moderate | MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery# Vulnerability — Blind SSRF via `CHECK_ARTICLE_URL` (MagicMirror² newsfeed) > Analysis of the PoC `exploit-ssrf-newsfeed.js`. > Target: `newsfeed/node_helper.js` of MagicMirror², socket.io namespace `/newsfeed`. --- ## Identification | Field | Value | |-------|-------| | **PoC file** | `exploit-ssrf-newsfeed.js` | | **Endpoint** | socket.io namespace `/newsfeed`, notification `CHECK_ARTICLE_URL` | | **Precondition** | reach the mirror's HTTP port (no authentication required) | --- ## Description The `checkArticleUrl()` function in `newsfeed/node_helper.js` runs `fetch(url, { method: "H |
| GitHub (opens in a new tab) | |
| GHSA-q4gh-4ffp-5cg8 | Moderate | MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables### Summary When `hideConfigSecrets: true` is enabled, MagicMirror redacts `SECRET_*` environment placeholders in the HTTP `/config` response, but the shared node-helper socket dispatcher expands `**SECRET_NAME**` placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as `**SECRET_API_KEY**` and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can |
| GitHub (opens in a new tab) | |
| GHSA-w26r-fwg8-rcp3 | Low | MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions### Summary MagicMirror applies `ipWhitelist` only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface but expects `ipWhitelist` to restrict access, an untrusted network client can connect directly to module Socket.IO namespaces and send arbitrary module-helper notifications. This allows unauthenticated server-side requests through default modules and can reach command execution in the default `u |
| GitHub (opens in a new tab) | |
| GHSA-w6x9-28jw-hq7j | Moderate | MagicMirror: ssrf calendar .js# Vulnerability — SSRF via `ADD_CALENDAR` (MagicMirror² calendar) > Analysis of the PoC `exploit-ssrf-calendar.js`. > Target: `calendar/node_helper.js` of MagicMirror², socket.io namespace `/calendar`. --- ## Identification | Field | Value | |-------|-------| | **PoC file** | `exploit-ssrf-calendar.js` | | **Endpoint** | socket.io namespace `/calendar`, notification `ADD_CALENDAR` | | **Precondition** | reach the mirror's HTTP port (no authentication required) | --- ## Description The `ADD_CALENDAR` handler in `calendar/node_helper.js` performs a **server-side** HTTP request to a URL th |
| GitHub (opens in a new tab) | |
| GHSA-ph6f-2cvq-79hq | Critical | MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint### Summary An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the `/cors` endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (`**VAR_NAME**`), enabling exfiltration of server-side secrets. ### Details The `/cors` endpoint in `js/server_functions.js` (function `cors()`, lines 37-78) acts as an open HTTP proxy with no authentication and no URL validation. Any user-supplied URL is fetched ser |
| GitHub (opens in a new tab) |
- GHSA-998g-7v5w-cr7gModerateMagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
< 2.37.0
# Vulnerability — Blind SSRF via `CHECK_ARTICLE_URL` (MagicMirror² newsfeed) > Analysis of the PoC `exploit-ssrf-newsfeed.js`. > Target: `newsfeed/node_helper.js` of MagicMirror², socket.io namespace `/newsfeed`. --- ## Identification | Field | Value | |-------|-------| | **PoC file** | `exploit-ssrf-newsfeed.js` | | **Endpoint** | socket.io namespace `/newsfeed`, notification `CHECK_ARTICLE_URL` | | **Precondition** | reach the mirror's HTTP port (no authentication required) | --- ## Description The `checkArticleUrl()` function in `newsfeed/node_helper.js` runs `fetch(url, { method: "H
CVE: CVE-2026-63642
- GHSA-q4gh-4ffp-5cg8ModerateMagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
< 2.37.0
### Summary When `hideConfigSecrets: true` is enabled, MagicMirror redacts `SECRET_*` environment placeholders in the HTTP `/config` response, but the shared node-helper socket dispatcher expands `**SECRET_NAME**` placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as `**SECRET_API_KEY**` and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can
CVE: CVE-2026-63640
- GHSA-w26r-fwg8-rcp3LowMagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
< 2.37.0
### Summary MagicMirror applies `ipWhitelist` only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface but expects `ipWhitelist` to restrict access, an untrusted network client can connect directly to module Socket.IO namespaces and send arbitrary module-helper notifications. This allows unauthenticated server-side requests through default modules and can reach command execution in the default `u
CVE: CVE-2026-63641
# Vulnerability — SSRF via `ADD_CALENDAR` (MagicMirror² calendar) > Analysis of the PoC `exploit-ssrf-calendar.js`. > Target: `calendar/node_helper.js` of MagicMirror², socket.io namespace `/calendar`. --- ## Identification | Field | Value | |-------|-------| | **PoC file** | `exploit-ssrf-calendar.js` | | **Endpoint** | socket.io namespace `/calendar`, notification `ADD_CALENDAR` | | **Precondition** | reach the mirror's HTTP port (no authentication required) | --- ## Description The `ADD_CALENDAR` handler in `calendar/node_helper.js` performs a **server-side** HTTP request to a URL th
CVE: CVE-2026-63643
- GHSA-ph6f-2cvq-79hqCriticalMagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
< 2.36.0
### Summary An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the `/cors` endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (`**VAR_NAME**`), enabling exfiltration of server-side secrets. ### Details The `/cors` endpoint in `js/server_functions.js` (function `cors()`, lines 37-78) acts as an open HTTP proxy with no authentication and no URL validation. Any user-supplied URL is fetched ser
CVE: CVE-2026-42281