{"id":"EUVD-2026-61070","revision":"67a6dbfb1d8344c5b55dabee59846438","records":[{"revision":"67a6dbfb1d8344c5b55dabee59846438","observedAt":"2026-11-03T12:06:15.164+00:00","statement":{"source":"euvd","id":"EUVD-2026-61070","aliases":["CVE-2026-63641","GHSA-w26r-fwg8-rcp3"],"title":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent…","description":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented non-loopback deployment that relies on ipWhitelist, an unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces, and js/node_helper.js dispatches arbitrary events and payloads to socketNotificationReceived. The default newsfeed and calendar helpers can make server-side requests to attacker-selected URLs, while the default updatenotification helper can reach child_process.exec when a third-party module update is pending and the attacker supplies an update command through the socket CONFIG path. This can expose internal services, manipulate module-helper state, and conditionally execute commands. This issue is fixed in version 2.37.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","score":2.3,"severity":null}],"references":["https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3","https://github.com/MagicMirrorOrg/MagicMirror/pull/4169","https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f","https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-61070","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 5:13:03 PM","dateUpdated":"Aug 18, 2026, 7:26:23 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-61070","identifiers":["EUVD-2026-61070","CVE-2026-63641","GHSA-w26r-fwg8-rcp3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}