Repository navigation
Security: MagicMirrorOrg/MagicMirror
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Config disclosure: /config/config.js is script-includable cross-origin, because isSameOrigin() treats a missing Origin header as same-originGHSA-6phw-3v27-j7c8 published
Oct 1, 2026 by KristjanESPERANTOHigh -
Stored XSS in MagicMirror² newsfeed module via allowedBasicHtmlTags fail-openGHSA-gqxq-8mrh-wwcj published
Oct 1, 2026 by KristjanESPERANTOHigh -
Unauthenticated OS command execution in MagicMirror² updatenotification moduleGHSA-jchh-mxrw-fjx8 published
Oct 1, 2026 by KristjanESPERANTOCritical -
Stored XSS in MagicMirror² calendar module via iCalendar event dataGHSA-8j94-ppf4-rf8m published
Oct 1, 2026 by KristjanESPERANTOHigh -
Incomplete fix of CVE-2026-63643: the client-IP resolver added by the fix trusts the leftmost `X-Forwarded-For`, so one header restores the calendar SSRF behind any same-host reverse proxyGHSA-vhhq-qx8x-xfcg published
Oct 1, 2026 by KristjanESPERANTOCritical -
MagicMirror SSRF IP Whitelist BypassGHSA-w74x-gm7h-97fp published
Oct 1, 2026 by KristjanESPERANTOModerate -
Missing Origin/CSRF validation lets any website drive privileged Socket.IO/HTTP actions through a whitelisted browser, up to RCE via installed modulesGHSA-2547-w82j-w2rv published
Oct 1, 2026 by KristjanESPERANTOHigh -
Weather module INIT_WEATHER: unauthenticated path traversal into dynamic require() gives arbitrary local code executionGHSA-x9mh-3c29-w6pw published
Oct 1, 2026 by KristjanESPERANTOHigh -
Incomplete hideConfigSecrets protection exposes config.jsGHSA-pwrh-jjgm-253v published
Oct 1, 2026 by KristjanESPERANTOModerate -
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variablesGHSA-q4gh-4ffp-5cg8 published
Jul 1, 2026 by KristjanESPERANTOModerate