Skip to content
OpenAdvisories

Product · MagicMirrorOrg

MagicMirror

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-63642 Public exploit

    MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

    MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(ur…

    MagicMirrorOrg MagicMirror magicmirror npm