Description
MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MagicMirrorOrg | MagicMirror | < 2.36.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Astaruf/CVE-2026-42281 ★ 0 · Apr 30, 2026
CVE-2026-42281 - MagicMirror <= 2.35.0 - Unauthenticated SSRF via /cors endpoint
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- MagicMirror <= 2.35.0 - Server-Side Request Forgery http/cves/2026/CVE-2026-42281.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | magicmirror | < 2.36.0 | 2.36.0 | GHSA-ph6f-2cvq-79hq |