CVE-2026-63641
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
MagicMirror² before version 2.37.0 applies ipWhitelist only as Express middleware, while the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. An unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces and dispatch arbitrary events and payloads to socketNotificationReceived. Default helpers can make server-side requests to attacker-selected URLs, and conditionally execute commands.
Risk Assessment
An attacker on the local network can access internal services, manipulate module-helper state, and conditionally execute commands on the server, potentially compromising confidentiality and integrity.
Recommendation
Update MagicMirror² to version 2.37.0 or later, which includes the fix. Additionally, consider implementing network-level protections such as firewalls to restrict access to the server port.
Original NVD description (English source)
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented non-loopback deployment that relies on ipWhitelist, an unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces, and js/node_helper.js dispatches arbitrary events and payloads to socketNotificationReceived. The default newsfeed and calendar helpers can make server-side requests to attacker-selected URLs, while the default updatenotification helper can reach child_process.exec when a third-party module update is pending and the attacker supplies an update command through the socket CONFIG path. This can expose internal services, manipulate module-helper state, and conditionally execute commands. This issue is fixed in version 2.37.0.