{"id":"EUVD-2026-30313","enisaUuid":"df1f1b2c-418a-3138-a2ec-e0fcbd04e4a2","description":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.","datePublished":"May 14, 2026, 3:46:41 PM","dateUpdated":"May 14, 2026, 7:51:14 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-ph6f-2cvq-79hq\n","aliases":"CVE-2026-42281\nGHSA-ph6f-2cvq-79hq\n","assigner":"GitHub_M","epss":1.62,"enisaIdProduct":[{"id":"18ad8e11-b883-3097-958a-4c29df049660","product":{"name":"MagicMirror","vendor":{"name":"MagicMirrorOrg"}},"product_version":"\u003c 2.36.0"}],"enisaIdVendor":[{"id":"4c36bf8a-2b30-375e-bb9e-6d2c35e8e99c","vendor":{"name":"MagicMirrorOrg"}}],"enisaIdVulnerability":[{"id":"1973de0c-547b-3010-89e7-fa3fafd030fc","vulnerability":{"id":"CVE-2026-42281","description":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.","datePublished":"May 14, 2026, 3:46:41 PM","dateUpdated":"May 14, 2026, 7:51:14 PM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-ph6f-2cvq-79hq\n","enisa_id":"EUVD-2026-30313\n","assigner":"GitHub_M","epss":1.62,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"24778f1e-5e00-389a-a97f-33dda1935868","product":{"name":"MagicMirror","vendor":{"name":"MagicMirrorOrg"}},"product_version":"\u003c 2.36.0"}],"vulnerabilityVendor":[{"id":"1b1f0cf8-2c82-3cec-a763-847c19601a45","vendor":{"name":"MagicMirrorOrg"}}]}},{"id":"de0e9aac-511a-356e-b2dd-77a29734b491","vulnerability":{"id":"GHSA-ph6f-2cvq-79hq","description":"MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint","datePublished":"May 5, 2026, 8:53:59 PM","dateUpdated":"Jun 8, 2026, 11:14:14 PM","baseScore":0.0,"references":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-ph6f-2cvq-79hq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42281\nhttps://github.com/MagicMirrorOrg/MagicMirror\nhttps://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.36.0\n","enisa_id":"EUVD-2026-30313\n","aliases":"CVE-2026-42281\nGHSA-ph6f-2cvq-79hq\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}