Vulnerability-Lookup

GHSA-Q4GH-4FFP-5CG8

Vulnerability from github – Published: 2026-08-18 18:00 – Updated: 2026-08-18 18:00

Summary

MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

Details

Summary

When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET_* environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands **SECRET_NAME** placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as **SECRET_API_KEY** and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can return the secret value to the socket client.

Details

The affected product is the npm package/application magicmirror at version 2.36.0, tested at commit fb41d24ef522e91e802e2a623ff6afbddeb3c9d8 from https://github.com/MagicMirrorOrg/MagicMirror.git.

The secret-redaction feature is implemented during config loading:

js/utils.js:117-123 loads a config.env file next to the config file into process.env when present.
js/utils.js:130-151 creates both a full config and a redacted config.
js/utils.js:137-140 redacts environment variables whose names start with SECRET_ to **SECRET_NAME** in the redacted config when hideConfigSecrets: true is present.
js/server.js:112-125 returns either configObj.redactedConf or configObj.fullConf from /config depending on config.hideConfigSecrets.

The disclosure root cause is the inbound socket dispatcher:

js/node_helper.js:88-103 registers a catch-all handler for each module namespace.
js/node_helper.js:91-99 checks config?.hideConfigSecrets and, for every inbound object payload, runs replaceSecretPlaceholder(JSON.stringify(payload)) before invoking socketNotificationReceived(...).
js/server_functions.js:23-34 implements replaceSecretPlaceholder(...) by replacing **SECRET_* **-style placeholders with process.env[...], unless global.config.cors === "allowAll".

This reverses the redaction boundary: redacted placeholders intended for the browser can be sent back to the server and expanded into real environment secret values inside helper payloads.

A confirmed echo path exists in the default weather helper:

defaultmodules/weather/node_helper.js:12-19 accepts INIT_WEATHER from the socket.
defaultmodules/weather/node_helper.js:27-31 copies config.instanceId from the attacker-controlled payload.
defaultmodules/weather/node_helper.js:47-52 attempts to dynamically load the requested weather provider.
defaultmodules/weather/node_helper.js:86-91 catches errors and sends WEATHER_ERROR with the same instanceId back to the namespace.

False-positive screening performed:

This is not a generic environment leak through /env; js/server_functions.js:221-240 returns only selected client environment paths.
The HTTP /config route does redact placeholders when hideConfigSecrets: true; the issue is that the inbound socket path expands those placeholders again before module helper code runs.
replaceSecretPlaceholder(...) intentionally refuses substitution when global.config.cors === "allowAll" (js/server_functions.js:29-34); the positive PoC used cors: "disabled", which is the shipped default (js/defaults.js:14). A negative control with no substitution produced the placeholder unchanged.
The attacker must know or infer a SECRET_* variable name. If the attacker can read the redacted /config response, placeholder names may be disclosed even when values are hidden. The PoC uses a known SECRET_MM_AUDIT test variable.
Network reachability follows the Socket.IO exposure model. With the shipped default address: "localhost" and loopback ipWhitelist, remote network reachability is limited. In documented non-loopback deployments, this combines with the Socket.IO access-control gap described separately.

Affected-version evidence: only magicmirror@2.36.0 at commit fb41d24ef522e91e802e2a623ff6afbddeb3c9d8 was tested. The affected range is unknown from this audit; earlier versions were not tested. No patched version or fix commit was identified locally.

PoC

The following safe local PoC was run from a clean checkout of MagicMirror at commit fb41d24ef522e91e802e2a623ff6afbddeb3c9d8. Because node_modules were not installed in this audit environment and package.json:52 has a destructive postinstall, the command uses dependency stubs while executing the vulnerable repository dispatcher and weather helper code. It writes no files and does not contact external services.

Positive trigger:

node -e 'const Module=require("module"); const orig=Module._load; Module._load=(r,p,m)=>{ if(r==="express") return { static:()=>()=>{} }; if(r==="logger") return {log(){},error(){},warn(){},info(){},debug(){}}; if(r==="#server_functions") return {replaceSecretPlaceholder:(input)=>input.replaceAll(/\*\*(SECRET_[^*]+)\*\*/g,(_m,g)=>process.env[g])}; return orig(r,p,m); }; require("./js/alias-resolver"); global.root_path=process.cwd(); global.config={hideConfigSecrets:true,cors:"disabled"}; process.env.SECRET_MM_AUDIT="secret-marker-42"; const Weather=require("./defaultmodules/weather/node_helper"); const helper=new Weather(); helper.setName("weather"); const sent=[]; helper.sendSocketNotification=(n,p)=>sent.push({n,p}); let onAny; const fakeIo={of(){return {on(_ev,cb){const socket={onAny(fn){onAny=fn;}}; cb(socket);}};}}; helper.setSocketIO(fakeIo); Promise.resolve(onAny("INIT_WEATHER",{instanceId:"**SECRET_MM_AUDIT**",weatherProvider:"definitely-not-a-provider",type:"current"})).then(()=>setTimeout(()=>{console.log(JSON.stringify(sent));},10));'

Observed output:

[{"n":"WEATHER_ERROR","p":{"instanceId":"secret-marker-42","error":"Cannot find module '/home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/defaultmodules/weather/providers/definitely-not-a-provider.js'\nRequire stack:\n- /home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/defaultmodules/weather/node_helper.js\n- /home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/[eval]"}}]

Expected vulnerable output: the weather error payload returned by the helper contains "instanceId":"secret-marker-42", proving the server substituted the SECRET_MM_AUDIT environment variable into an attacker-controlled socket payload and returned it to the client.

Negative/control trigger simulating no inbound placeholder substitution:

node -e 'const Module=require("module"); const orig=Module._load; Module._load=(r,p,m)=>{ if(r==="express") return { static:()=>()=>{} }; if(r==="logger") return {log(){},error(){},warn(){},info(){},debug(){}}; if(r==="#server_functions") return {replaceSecretPlaceholder:(input)=>input}; return orig(r,p,m); }; require("./js/alias-resolver"); global.root_path=process.cwd(); global.config={hideConfigSecrets:true,cors:"allowAll"}; process.env.SECRET_MM_AUDIT="secret-marker-42"; const Weather=require("./defaultmodules/weather/node_helper"); const helper=new Weather(); helper.setName("weather"); const sent=[]; helper.sendSocketNotification=(n,p)=>sent.push({n,p}); let onAny; const fakeIo={of(){return {on(_ev,cb){const socket={onAny(fn){onAny=fn;}}; cb(socket);}};}}; helper.setSocketIO(fakeIo); Promise.resolve(onAny("INIT_WEATHER",{instanceId:"**SECRET_MM_AUDIT**",weatherProvider:"definitely-not-a-provider",type:"current"})).then(()=>setTimeout(()=>{console.log(JSON.stringify(sent));},10));'

Observed control output:

[{"n":"WEATHER_ERROR","p":{"instanceId":"**SECRET_MM_AUDIT**","error":"Cannot find module '/home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/defaultmodules/weather/providers/definitely-not-a-provider.js'\nRequire stack:\n- /home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/defaultmodules/weather/node_helper.js\n- /home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/[eval]"}}]

Expected control output: the placeholder remains **SECRET_MM_AUDIT**, showing that the positive case depends on the vulnerable server-side placeholder expansion step.

Final repro re-check: both the positive and negative harnesses were re-run after drafting, and the observed outputs above are from this environment. No cleanup was required.

Impact

Any client that can connect to a module Socket.IO namespace can disclose SECRET_* environment variables by sending known placeholder names in object payloads that are expanded by js/node_helper.js before helper processing. This undermines the purpose of hideConfigSecrets: true: secrets are hidden in the HTTP config response but can be converted back into their real values through inbound socket payloads.

The confidentiality impact depends on what the deployment stores under SECRET_* variables. MagicMirror configurations commonly include API tokens, calendar credentials, service keys, or network allowlist values in config/environment variables. The PoC proves disclosure of a test secret through a default helper echo path.

CVSS 3.1 rationale: AV:A because MagicMirror is intended for trusted local/private networks and remote exploitation requires a reachable local/private-network deployment; AC:L because once namespace access is available the attacker only needs a known or guessed SECRET_* name and an invalid weather provider to trigger the echo; PR:N because no application authentication is required; UI:N because the attacker sends socket messages directly; S:U because the impact is disclosure of secrets from the vulnerable application's own process environment; C:H because environment secrets can include credentials/API tokens; I:N/A:N because this report proves disclosure only.

Suggested remediation

Do not expand SECRET_* placeholders in inbound socket payloads. The redaction boundary should be one-way: server-to-client responses may contain placeholders, but client-to-server messages must not be treated as authority to retrieve real environment values.

Concrete fixes:

Remove the replaceSecretPlaceholder(JSON.stringify(payload)) call from js/node_helper.js:91-99 for inbound socket payloads.
If a specific module legitimately needs secret material, resolve it only from server-loaded trusted configuration, not from client-supplied placeholders.
Keep hideConfigSecrets redaction for /config, but avoid disclosing placeholder names to clients when not necessary.
Add regression tests that set hideConfigSecrets: true and SECRET_TEST=value, send a socket payload containing **SECRET_TEST**, and assert that every helper receives/returns the literal placeholder rather than the secret value.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "magicmirror"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.37.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63640"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T18:00:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nWhen `hideConfigSecrets: true` is enabled, MagicMirror redacts `SECRET_*` environment placeholders in the HTTP `/config` response, but the shared node-helper socket dispatcher expands `**SECRET_NAME**` placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as `**SECRET_API_KEY**` and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can return the secret value to the socket client.\n\n### Details\nThe affected product is the npm package/application `magicmirror` at version `2.36.0`, tested at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8` from `https://github.com/MagicMirrorOrg/MagicMirror.git`.\n\nThe secret-redaction feature is implemented during config loading:\n\n- `js/utils.js:117-123` loads a `config.env` file next to the config file into `process.env` when present.\n- `js/utils.js:130-151` creates both a full config and a redacted config.\n- `js/utils.js:137-140` redacts environment variables whose names start with `SECRET_` to `**SECRET_NAME**` in the redacted config when `hideConfigSecrets: true` is present.\n- `js/server.js:112-125` returns either `configObj.redactedConf` or `configObj.fullConf` from `/config` depending on `config.hideConfigSecrets`.\n\nThe disclosure root cause is the inbound socket dispatcher:\n\n- `js/node_helper.js:88-103` registers a catch-all handler for each module namespace.\n- `js/node_helper.js:91-99` checks `config?.hideConfigSecrets` and, for every inbound object payload, runs `replaceSecretPlaceholder(JSON.stringify(payload))` before invoking `socketNotificationReceived(...)`.\n- `js/server_functions.js:23-34` implements `replaceSecretPlaceholder(...)` by replacing `**SECRET_* **`-style placeholders with `process.env[...]`, unless `global.config.cors === \"allowAll\"`.\n\nThis reverses the redaction boundary: redacted placeholders intended for the browser can be sent back to the server and expanded into real environment secret values inside helper payloads.\n\nA confirmed echo path exists in the default weather helper:\n\n- `defaultmodules/weather/node_helper.js:12-19` accepts `INIT_WEATHER` from the socket.\n- `defaultmodules/weather/node_helper.js:27-31` copies `config.instanceId` from the attacker-controlled payload.\n- `defaultmodules/weather/node_helper.js:47-52` attempts to dynamically load the requested weather provider.\n- `defaultmodules/weather/node_helper.js:86-91` catches errors and sends `WEATHER_ERROR` with the same `instanceId` back to the namespace.\n\nFalse-positive screening performed:\n\n- This is not a generic environment leak through `/env`; `js/server_functions.js:221-240` returns only selected client environment paths.\n- The HTTP `/config` route does redact placeholders when `hideConfigSecrets: true`; the issue is that the inbound socket path expands those placeholders again before module helper code runs.\n- `replaceSecretPlaceholder(...)` intentionally refuses substitution when `global.config.cors === \"allowAll\"` (`js/server_functions.js:29-34`); the positive PoC used `cors: \"disabled\"`, which is the shipped default (`js/defaults.js:14`). A negative control with no substitution produced the placeholder unchanged.\n- The attacker must know or infer a `SECRET_*` variable name. If the attacker can read the redacted `/config` response, placeholder names may be disclosed even when values are hidden. The PoC uses a known `SECRET_MM_AUDIT` test variable.\n- Network reachability follows the Socket.IO exposure model. With the shipped default `address: \"localhost\"` and loopback `ipWhitelist`, remote network reachability is limited. In documented non-loopback deployments, this combines with the Socket.IO access-control gap described separately.\n\nAffected-version evidence: only `magicmirror@2.36.0` at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8` was tested. The affected range is unknown from this audit; earlier versions were not tested. No patched version or fix commit was identified locally.\n\n### PoC\nThe following safe local PoC was run from a clean checkout of MagicMirror at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8`. Because `node_modules` were not installed in this audit environment and `package.json:52` has a destructive `postinstall`, the command uses dependency stubs while executing the vulnerable repository dispatcher and weather helper code. It writes no files and does not contact external services.\n\nPositive trigger:\n\n```bash\nnode -e \u0027const Module=require(\"module\"); const orig=Module._load; Module._load=(r,p,m)=\u003e{ if(r===\"express\") return { static:()=\u003e()=\u003e{} }; if(r===\"logger\") return {log(){},error(){},warn(){},info(){},debug(){}}; if(r===\"#server_functions\") return {replaceSecretPlaceholder:(input)=\u003einput.replaceAll(/\\*\\*(SECRET_[^*]+)\\*\\*/g,(_m,g)=\u003eprocess.env[g])}; return orig(r,p,m); }; require(\"./js/alias-resolver\"); global.root_path=process.cwd(); global.config={hideConfigSecrets:true,cors:\"disabled\"}; process.env.SECRET_MM_AUDIT=\"secret-marker-42\"; const Weather=require(\"./defaultmodules/weather/node_helper\"); const helper=new Weather(); helper.setName(\"weather\"); const sent=[]; helper.sendSocketNotification=(n,p)=\u003esent.push({n,p}); let onAny; const fakeIo={of(){return {on(_ev,cb){const socket={onAny(fn){onAny=fn;}}; cb(socket);}};}}; helper.setSocketIO(fakeIo); Promise.resolve(onAny(\"INIT_WEATHER\",{instanceId:\"**SECRET_MM_AUDIT**\",weatherProvider:\"definitely-not-a-provider\",type:\"current\"})).then(()=\u003esetTimeout(()=\u003e{console.log(JSON.stringify(sent));},10));\u0027\n```\n\nObserved output:\n\n```json\n[{\"n\":\"WEATHER_ERROR\",\"p\":{\"instanceId\":\"secret-marker-42\",\"error\":\"Cannot find module \u0027/home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/defaultmodules/weather/providers/definitely-not-a-provider.js\u0027\\nRequire stack:\\n- /home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/defaultmodules/weather/node_helper.js\\n- /home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/[eval]\"}}]\n```\n\nExpected vulnerable output: the weather error payload returned by the helper contains `\"instanceId\":\"secret-marker-42\"`, proving the server substituted the `SECRET_MM_AUDIT` environment variable into an attacker-controlled socket payload and returned it to the client.\n\nNegative/control trigger simulating no inbound placeholder substitution:\n\n```bash\nnode -e \u0027const Module=require(\"module\"); const orig=Module._load; Module._load=(r,p,m)=\u003e{ if(r===\"express\") return { static:()=\u003e()=\u003e{} }; if(r===\"logger\") return {log(){},error(){},warn(){},info(){},debug(){}}; if(r===\"#server_functions\") return {replaceSecretPlaceholder:(input)=\u003einput}; return orig(r,p,m); }; require(\"./js/alias-resolver\"); global.root_path=process.cwd(); global.config={hideConfigSecrets:true,cors:\"allowAll\"}; process.env.SECRET_MM_AUDIT=\"secret-marker-42\"; const Weather=require(\"./defaultmodules/weather/node_helper\"); const helper=new Weather(); helper.setName(\"weather\"); const sent=[]; helper.sendSocketNotification=(n,p)=\u003esent.push({n,p}); let onAny; const fakeIo={of(){return {on(_ev,cb){const socket={onAny(fn){onAny=fn;}}; cb(socket);}};}}; helper.setSocketIO(fakeIo); Promise.resolve(onAny(\"INIT_WEATHER\",{instanceId:\"**SECRET_MM_AUDIT**\",weatherProvider:\"definitely-not-a-provider\",type:\"current\"})).then(()=\u003esetTimeout(()=\u003e{console.log(JSON.stringify(sent));},10));\u0027\n```\n\nObserved control output:\n\n```json\n[{\"n\":\"WEATHER_ERROR\",\"p\":{\"instanceId\":\"**SECRET_MM_AUDIT**\",\"error\":\"Cannot find module \u0027/home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/defaultmodules/weather/providers/definitely-not-a-provider.js\u0027\\nRequire stack:\\n- /home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/defaultmodules/weather/node_helper.js\\n- /home/sondt23/Github/Research/CVE/auto-github-cve/github-repo/MagicMirror/[eval]\"}}]\n```\n\nExpected control output: the placeholder remains `**SECRET_MM_AUDIT**`, showing that the positive case depends on the vulnerable server-side placeholder expansion step.\n\nFinal repro re-check: both the positive and negative harnesses were re-run after drafting, and the observed outputs above are from this environment. No cleanup was required.\n\n### Impact\nAny client that can connect to a module Socket.IO namespace can disclose `SECRET_*` environment variables by sending known placeholder names in object payloads that are expanded by `js/node_helper.js` before helper processing. This undermines the purpose of `hideConfigSecrets: true`: secrets are hidden in the HTTP config response but can be converted back into their real values through inbound socket payloads.\n\nThe confidentiality impact depends on what the deployment stores under `SECRET_*` variables. MagicMirror configurations commonly include API tokens, calendar credentials, service keys, or network allowlist values in config/environment variables. The PoC proves disclosure of a test secret through a default helper echo path.\n\nCVSS 3.1 rationale: AV:A because MagicMirror is intended for trusted local/private networks and remote exploitation requires a reachable local/private-network deployment; AC:L because once namespace access is available the attacker only needs a known or guessed `SECRET_*` name and an invalid weather provider to trigger the echo; PR:N because no application authentication is required; UI:N because the attacker sends socket messages directly; S:U because the impact is disclosure of secrets from the vulnerable application\u0027s own process environment; C:H because environment secrets can include credentials/API tokens; I:N/A:N because this report proves disclosure only.\n\n### Suggested remediation\nDo not expand `SECRET_*` placeholders in inbound socket payloads. The redaction boundary should be one-way: server-to-client responses may contain placeholders, but client-to-server messages must not be treated as authority to retrieve real environment values.\n\nConcrete fixes:\n\n- Remove the `replaceSecretPlaceholder(JSON.stringify(payload))` call from `js/node_helper.js:91-99` for inbound socket payloads.\n- If a specific module legitimately needs secret material, resolve it only from server-loaded trusted configuration, not from client-supplied placeholders.\n- Keep `hideConfigSecrets` redaction for `/config`, but avoid disclosing placeholder names to clients when not necessary.\n- Add regression tests that set `hideConfigSecrets: true` and `SECRET_TEST=value`, send a socket payload containing `**SECRET_TEST**`, and assert that every helper receives/returns the literal placeholder rather than the secret value.",
  "id": "GHSA-q4gh-4ffp-5cg8",
  "modified": "2026-08-18T18:00:16Z",
  "published": "2026-08-18T18:00:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4184"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/commit/ca7b752025962441196e148f8c1bc04b90117979"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables"
}

CVE-2026-63640 (GCVE-0-2026-63640)

Vulnerability from cvelistv5 – Published: 2026-08-18 17:35 – Updated: 2026-08-18 17:56

Title

MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

Summary

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 17:56 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/MagicMirrorOrg/MagicMirror/sec…	x_refsource_CONFIRM
https://github.com/MagicMirrorOrg/MagicMirror/pull/4184	x_refsource_MISC
https://github.com/MagicMirrorOrg/MagicMirror/com…	x_refsource_MISC
https://github.com/MagicMirrorOrg/MagicMirror/rel…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
MagicMirrorOrg	MagicMirror	Affected: < 2.37.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63640",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T17:56:24.747800Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T17:56:32.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MagicMirror",
          "vendor": "MagicMirrorOrg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.37.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MagicMirror\u00b2 is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T17:35:44.944Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8"
        },
        {
          "name": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4184",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4184"
        },
        {
          "name": "https://github.com/MagicMirrorOrg/MagicMirror/commit/ca7b752025962441196e148f8c1bc04b90117979",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/MagicMirrorOrg/MagicMirror/commit/ca7b752025962441196e148f8c1bc04b90117979"
        },
        {
          "name": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"
        }
      ],
      "source": {
        "advisory": "GHSA-q4gh-4ffp-5cg8",
        "discovery": "UNKNOWN"
      },
      "title": "MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63640",
    "datePublished": "2026-08-18T17:35:44.944Z",
    "dateReserved": "2026-07-17T14:11:15.483Z",
    "dateUpdated": "2026-08-18T17:56:32.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-Q4GH-4FFP-5CG8

Summary

Details

PoC

Impact

Suggested remediation

CVE-2026-63640 (GCVE-0-2026-63640)

Tags

Sightings

Nomenclature