{"action":"Upgrade magicmirror to 2.37.0 or later.","affected":[{"fixed":"2.37.0","introduced":"0"}],"component":"magicmirror","cve_ids":["CVE-2026-63643"],"ecosystem":"npm","epss":0.00665,"exploited":false,"fixed_versions":["2.37.0"],"ghsa_id":"GHSA-w6x9-28jw-hq7j","id":"tcs_01M5KGE74STPQ5B49BMQ2GXKAD","modified_at":"2026-08-18T17:41:04.426800Z","published_at":"2026-08-18T17:26:51Z","references":["https://osv.dev/vulnerability/GHSA-w6x9-28jw-hq7j","https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j","https://github.com/MagicMirrorOrg/MagicMirror/pull/4169","https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f","https://github.com/MagicMirrorOrg/MagicMirror","https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-w6x9-28jw-hq7j","url":"https://osv.dev/vulnerability/GHSA-w6x9-28jw-hq7j"}],"summary":"MagicMirror: ssrf calendar .js"}