CVE-2026-63640
1 advisory.
npm/magicmirror CVE-2026-63640: medium 4.3, EPSS 0.30%
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
Action: Upgrade magicmirror to 2.37.0 or later.
npm i magicmirror@2.37.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.37.0 | - |
Fixed versions
| 2.37.0 |
Sources
- osv: GHSA-q4gh-4ffp-5cg8
- https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8
- https://github.com/MagicMirrorOrg/MagicMirror/pull/4184
- https://github.com/MagicMirrorOrg/MagicMirror/commit/ca7b752025962441196e148f8c1bc04b90117979
- https://github.com/MagicMirrorOrg/MagicMirror
- https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0
CVE-2026-63640 · published · modified · JSON