CVE-2026-63640

Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.37.0

Description When the hideConfigSecrets setting is enabled, the catch-all socket dispatcher in js/node helper.js processes inbound object payloads through the replaceSecretPlaceholder function in js/server functions.js before calling socketNotificationReceived(). A client connected to a loaded module namespace can submit a SECRET API KEY placeholder, which triggers the server to replace it with the actual process environment value. For instance, the default weather helper accepts INIT WEATHER, copies an attacker-controlled instanceId, and returns it via WEATHER ERROR, creating an echo path that discloses API tokens, credentials, or service keys stored in SECRET variables.

Recommendations Update MagicMirror² to version 2.37.0.