Skip to content
OpenAdvisories

Package · npm

magicmirror

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-63642 Public exploit

    MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

    MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(ur…

    MagicMirrorOrg MagicMirror magicmirror npm
  • Critical 9.2
    CVE-2026-42281 Public exploit

    MagicMirror²: Unauthenticated SSRF via /cors endpoint

    MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requ…

    MagicMirrorOrg MagicMirror magicmirror npm