CVE-2026-63642

MagicMirror² is an open source modular smart mirror platform. Prior to version 2.36.0, there is a Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint that allows remote attackers to force arbitrary HTTP requests to internal networks and localhost services.

MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability in the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js that accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive. This issue is fixed in version 2.37.0.

MagicMirror² before version 2.37.0 applies ipWhitelist only as Express middleware, while the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. An unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces and dispatch arbitrary events and payloads to socketNotificationReceived. Default helpers can make server-side requests to attacker-selected URLs, and conditionally execute commands.

MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability when hideConfigSecrets is enabled. The catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.