CVE-2026-63641
1 advisory.
npm/magicmirror CVE-2026-63641: low
MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
Action: Upgrade magicmirror to 2.37.0 or later.
npm i magicmirror@2.37.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.37.0 | - |
Fixed versions
| 2.37.0 |
Sources
- osv: GHSA-w26r-fwg8-rcp3
- https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3
- https://github.com/MagicMirrorOrg/MagicMirror/pull/4169
- https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f
- https://github.com/MagicMirrorOrg/MagicMirror
- https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0
CVE-2026-63641 · published · modified · JSON