{"id":"EUVD-2026-61079","revision":"0eb5b9efab9247a488086063d3282611","records":[{"revision":"0eb5b9efab9247a488086063d3282611","observedAt":"2026-10-28T08:42:18.592+00:00","statement":{"source":"euvd","id":"EUVD-2026-61079","aliases":["CVE-2026-63640","GHSA-q4gh-4ffp-5cg8"],"title":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in j…","description":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":null}],"references":["https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8","https://github.com/MagicMirrorOrg/MagicMirror/pull/4184","https://github.com/MagicMirrorOrg/MagicMirror/commit/ca7b752025962441196e148f8c1bc04b90117979","https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-61079","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 5:35:44 PM","dateUpdated":"Aug 18, 2026, 5:56:32 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-61079","identifiers":["EUVD-2026-61079","CVE-2026-63640","GHSA-q4gh-4ffp-5cg8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}