{"id":"EUVD-2026-61079","enisaUuid":"0f56cdf9-1288-3ac6-a0f1-f4e3117dbbb3","description":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.","datePublished":"Aug 18, 2026, 5:35:44 PM","dateUpdated":"Aug 18, 2026, 5:56:32 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8\nhttps://github.com/MagicMirrorOrg/MagicMirror/pull/4184\nhttps://github.com/MagicMirrorOrg/MagicMirror/commit/ca7b752025962441196e148f8c1bc04b90117979\nhttps://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0\n","aliases":"CVE-2026-63640\nGHSA-q4gh-4ffp-5cg8\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"7c09d71f-78e1-330c-a895-e4fc32fd24a8","product":{"name":"MagicMirror","vendor":{"name":"MagicMirrorOrg"}},"product_version":"\u003c 2.37.0"}],"enisaIdVendor":[{"id":"68d12bd9-3991-330a-ac20-90565e1a843d","vendor":{"name":"MagicMirrorOrg"}}],"enisaIdVulnerability":[{"id":"eb250a0a-4296-3ee8-a403-275bfb4e08d6","vulnerability":{"id":"CVE-2026-63640","description":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.","datePublished":"Aug 18, 2026, 5:35:44 PM","dateUpdated":"Aug 18, 2026, 5:56:32 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8\nhttps://github.com/MagicMirrorOrg/MagicMirror/pull/4184\nhttps://github.com/MagicMirrorOrg/MagicMirror/commit/ca7b752025962441196e148f8c1bc04b90117979\nhttps://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0\n","enisa_id":"EUVD-2026-61079\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 3, 2026, 7:15:42 AM","vulnerabilityProduct":[{"id":"5b3d9498-54bb-3246-a5b4-1d9841c1275c","product":{"name":"MagicMirror","vendor":{"name":"MagicMirrorOrg"}},"product_version":"\u003c 2.37.0"}],"vulnerabilityVendor":[{"id":"59ef884b-4376-3e5e-9bc9-a1ac4554dfaf","vendor":{"name":"MagicMirrorOrg"}}]}},{"id":"ff529ebc-3dd4-352a-b87b-1341de40f49c","vulnerability":{"id":"GHSA-q4gh-4ffp-5cg8","description":"MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables","datePublished":"Aug 18, 2026, 6:00:16 PM","dateUpdated":"Aug 18, 2026, 6:00:16 PM","baseScore":0.0,"references":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8\nhttps://github.com/MagicMirrorOrg/MagicMirror/pull/4184\nhttps://github.com/MagicMirrorOrg/MagicMirror/commit/ca7b752025962441196e148f8c1bc04b90117979\nhttps://github.com/MagicMirrorOrg/MagicMirror\nhttps://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0\n","enisa_id":"EUVD-2026-61079\n","aliases":"GHSA-q4gh-4ffp-5cg8\nCVE-2026-63640\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}