{"action":"Upgrade magicmirror to 2.37.0 or later.","affected":[{"fixed":"2.37.0","introduced":"0"}],"component":"magicmirror","cve_ids":["CVE-2026-63640"],"ecosystem":"npm","epss":0.00298,"exploited":false,"fixed_versions":["2.37.0"],"ghsa_id":"GHSA-q4gh-4ffp-5cg8","id":"tcs_01M5KG53A5R75JNY6B0ZPEH93B","modified_at":"2026-08-18T18:50:02.876711Z","published_at":"2026-08-18T18:00:16Z","references":["https://osv.dev/vulnerability/GHSA-q4gh-4ffp-5cg8","https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8","https://github.com/MagicMirrorOrg/MagicMirror/pull/4184","https://github.com/MagicMirrorOrg/MagicMirror/commit/ca7b752025962441196e148f8c1bc04b90117979","https://github.com/MagicMirrorOrg/MagicMirror","https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-q4gh-4ffp-5cg8","url":"https://osv.dev/vulnerability/GHSA-q4gh-4ffp-5cg8"}],"summary":"MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables"}