Skip to content
OpenAdvisories

Vendor

MagicMirrorOrg

5 known vulnerabilities.

Products

MagicMirror 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-63640

    MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

    MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.…

    MagicMirrorOrg MagicMirror magicmirror npm
  • Medium 6.3
    CVE-2026-63642 Public exploit

    MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

    MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(ur…

    MagicMirrorOrg MagicMirror magicmirror npm
  • Medium 6.3
    CVE-2026-63643

    MagicMirror: ssrf calendar .js

    MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated S…

    MagicMirrorOrg MagicMirror magicmirror npm