{"action":"Upgrade magicmirror to 2.37.0 or later.","affected":[{"fixed":"2.37.0","introduced":"0"}],"component":"magicmirror","cve_ids":["CVE-2026-63642"],"ecosystem":"npm","epss":0.00496,"exploited":false,"fixed_versions":["2.37.0"],"ghsa_id":"GHSA-998g-7v5w-cr7g","id":"tcs_01M5KFFB6V3MM1V2462CDC5WPC","modified_at":"2026-08-18T17:41:04.517510Z","published_at":"2026-08-18T17:26:46Z","references":["https://osv.dev/vulnerability/GHSA-998g-7v5w-cr7g","https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g","https://github.com/MagicMirrorOrg/MagicMirror/pull/4169","https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f","https://github.com/MagicMirrorOrg/MagicMirror","https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-998g-7v5w-cr7g","url":"https://osv.dev/vulnerability/GHSA-998g-7v5w-cr7g"}],"summary":"MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery"}