{"action":"Upgrade magicmirror to 2.37.0 or later.","affected":[{"fixed":"2.37.0","introduced":"0"}],"component":"magicmirror","cve_ids":["CVE-2026-63641"],"ecosystem":"npm","epss":0.00433,"exploited":false,"fixed_versions":["2.37.0"],"ghsa_id":"GHSA-w26r-fwg8-rcp3","id":"tcs_01M5KGDGNETRBYS326SMQ90FKM","modified_at":"2026-08-18T17:41:04.600125Z","published_at":"2026-08-18T17:26:41Z","references":["https://osv.dev/vulnerability/GHSA-w26r-fwg8-rcp3","https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3","https://github.com/MagicMirrorOrg/MagicMirror/pull/4169","https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f","https://github.com/MagicMirrorOrg/MagicMirror","https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-w26r-fwg8-rcp3","url":"https://osv.dev/vulnerability/GHSA-w26r-fwg8-rcp3"}],"summary":"MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions"}