CVE-2026-63641

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63641", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-17T14:11:15.483Z", "datePublished": "2026-08-18T17:13:03.109Z", "dateUpdated": "2026-08-18T19:26:23.631Z"}, "containers": {"cna": {"title": "MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3"}, {"name": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4169", "tags": ["x_refsource_MISC"], "url": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4169"}, {"name": "https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f", "tags": ["x_refsource_MISC"], "url": "https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f"}, {"name": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"}], "affected": [{"vendor": "MagicMirrorOrg", "product": "MagicMirror", "versions": [{"version": "< 2.37.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T17:13:03.109Z"}, "descriptions": [{"lang": "en", "value": "MagicMirror\u00b2 is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented non-loopback deployment that relies on ipWhitelist, an unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces, and js/node_helper.js dispatches arbitrary events and payloads to socketNotificationReceived. The default newsfeed and calendar helpers can make server-side requests to attacker-selected URLs, while the default updatenotification helper can reach child_process.exec when a third-party module update is pending and the attacker supplies an update command through the socket CONFIG path. This can expose internal services, manipulate module-helper state, and conditionally execute commands. This issue is fixed in version 2.37.0."}], "source": {"advisory": "GHSA-w26r-fwg8-rcp3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T19:25:53.057078Z", "id": "CVE-2026-63641", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T19:26:23.631Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63641", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T19:25:53.057078Z"}}}], "references": [{"url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T19:26:19.352Z"}}], "cna": {"title": "MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions", "source": {"advisory": "GHSA-w26r-fwg8-rcp3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "ADJACENT", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "MagicMirrorOrg", "product": "MagicMirror", "versions": [{"status": "affected", "version": "< 2.37.0"}]}], "references": [{"url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3", "name": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4169", "name": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4169", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f", "name": "https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0", "name": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MagicMirror\u00b2 is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented non-loopback deployment that relies on ipWhitelist, an unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces, and js/node_helper.js dispatches arbitrary events and payloads to socketNotificationReceived. The default newsfeed and calendar helpers can make server-side requests to attacker-selected URLs, while the default updatenotification helper can reach child_process.exec when a third-party module update is pending and the attacker supplies an update command through the socket CONFIG path. This can expose internal services, manipulate module-helper state, and conditionally execute commands. This issue is fixed in version 2.37.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T17:13:03.109Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63641", "state": "PUBLISHED", "dateUpdated": "2026-08-18T19:26:23.631Z", "dateReserved": "2026-07-17T14:11:15.483Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T17:13:03.109Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MagicMirror", "vendor": "MagicMirrorOrg", "versions": [{"status": "affected", "version": "< 2.37.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MagicMirror\u00b2 is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented non-loopback deployment that relies on ipWhitelist, an unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces, and js/node_helper.js dispatches arbitrary events and payloads to socketNotificationReceived. The default newsfeed and calendar helpers can make server-side requests to attacker-selected URLs, while the default updatenotification helper can reach child_process.exec when a third-party module update is pending and the attacker supplies an update command through the socket CONFIG path. This can expose internal services, manipulate module-helper state, and conditionally execute commands. This issue is fixed in version 2.37.0."}, {"lang": "es", "value": "MagicMirror\u00b2 es una plataforma de espejo inteligente modular de c\u00f3digo abierto. Antes de la versi\u00f3n 2.37.0, MagicMirror aplica ipWhitelist solo como middleware de Express, mientras que el servidor de Socket.IO en js/server.js est\u00e1 conectado directamente al servidor HTTP sin comprobaciones equivalentes de lista de permitidos de IP, origen o autenticaci\u00f3n de espacio de nombres. En una implementaci\u00f3n documentada sin bucle de retorno que depende de ipWhitelist, un cliente de red adyacente no autenticado puede conectarse directamente a los espacios de nombres de Socket.IO del m\u00f3dulo, y js/node_helper.js despacha eventos y cargas \u00fatiles arbitrarios a socketNotificationReceived. Los ayudantes predeterminados de noticias y calendario pueden realizar solicitudes del lado del servidor a URL seleccionadas por el atacante, mientras que el ayudante predeterminado de notificaci\u00f3n de actualizaci\u00f3n puede alcanzar child_process.exec cuando una actualizaci\u00f3n de m\u00f3dulo de terceros est\u00e1 pendiente y el atacante suministra un comando de actualizaci\u00f3n a trav\u00e9s de la ruta CONFIG del socket. Esto puede exponer servicios internos, manipular el estado del ayudante del m\u00f3dulo y ejecutar comandos condicionalmente. Este problema se soluciona en la versi\u00f3n 2.37.0."}], "id": "CVE-2026-63641", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63641", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T19:25:53.057078Z", "version": "2.0.3"}}]}, "published": "2026-08-18T18:19:11.963", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f"}, {"source": "security-advisories@github.com", "url": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4169"}, {"source": "security-advisories@github.com", "url": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.37.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MagicMirror", "source": "cna", "vendor": "MagicMirrorOrg"}, "product": "magicmirror", "vendor": "magicmirrororg"}], "created": "2026-08-18T18:45:03.211621+00:00", "updated": "2026-08-18T19:00:12.167803+00:00", "vendors": ["magicmirrororg", "magicmirrororg$PRODUCT$magicmirror"]}