CVE-2026-63643

npm/magicmirror CVE-2026-63643: medium

MagicMirror: ssrf calendar .js

Action: Upgrade magicmirror to 2.37.0 or later.

npm i magicmirror@2.37.0

Affected

Fixed versions

Sources

• osv: GHSA-w6x9-28jw-hq7j
• https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j
• https://github.com/MagicMirrorOrg/MagicMirror/pull/4169
• https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f
• https://github.com/MagicMirrorOrg/MagicMirror
• https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0

CVE-2026-63643 · published 2026-08-18T17:26:51Z · modified 2026-08-18T17:41:04.426800Z · JSON