CVE-2026-42281

MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability in the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js that accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive. This issue is fixed in version 2.37.0.

MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability in checkArticleUrl in defaultmodules/newsfeed/node_helper.js that accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.

MagicMirror² before version 2.37.0 applies ipWhitelist only as Express middleware, while the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. An unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces and dispatch arbitrary events and payloads to socketNotificationReceived. Default helpers can make server-side requests to attacker-selected URLs, and conditionally execute commands.

MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability when hideConfigSecrets is enabled. The catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.