CVE-2026-63641

Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.37.0

Description The application applies ipWhitelist only as Express middleware, leaving the Socket.IO server in js/server.js attached to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In non-loopback deployments relying on ipWhitelist, an unauthenticated client on an adjacent network can connect to module Socket.IO namespaces. This allows js/node helper.js to dispatch arbitrary events and payloads to socketNotificationReceived(). Consequently, default newsfeed and calendar helpers may make server-side requests to attacker-selected URLs. Additionally, the default updatenotification helper can reach child process.exec() if a third-party module update is pending and an attacker provides an update command via the socket CONFIG path. This can lead to the exposure of internal services, manipulation of module-helper state, and conditional command execution.

Recommendations Update to version 2.37.0.