CVE-2026-63640 with a CVSS score of 4.3 is a medium-severity vulnerability affecting magicmirror versions < 2.37.0 in the MagicMirror application that allows an attacker to disclose SECRET_* environment variables through the socket payload secret placeholder expansion mechanism. When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET_* environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands **SECRET_NAME** placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as **SECRET_API_KEY** and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can return the secret value to the socket client. The affected product is the npm package/application magicmirror at version 2.36.0, tested at commit fb41d24ef522e91e802e2a623ff6afbddeb3c9d8 from. The disclosure root cause is the inbound socket dispatcher that reverses the redaction boundary: redacted placeholders intended for the browser can be sent back to the server and expanded into real environment secret values inside helper payloads. A confirmed echo path exists in the default weather helper that accepts INIT_WEATHER from the socket, copies config.instanceId from the attacker-controlled payload, attempts to dynamically load the requested weather provider, catches errors, and sends WEATHER_ERROR with the same instanceId back to the namespace.
We recommend you to update MagicMirror to version 2.37.0.[/subscribe_to_unlock_form]
CVE-2026-63640 with a CVSS score of 4.3 is a medium-severity vulnerability affecting magicmirror versions < 2.37.0 in the MagicMirror application that allows an attacker to disclose SECRET_* environment variables through the socket payload secret placeholder expansion mechanism. When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET_* environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands **SECRET_NAME** placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as **SECRET_API_KEY** and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can return the secret value to the socket client. The affected product is the npm package/application magicmirror at version 2.36.0, tested at commit fb41d24ef522e91e802e2a623ff6afbddeb3c9d8 from. The disclosure root cause is the inbound socket dispatcher that reverses the redaction boundary: redacted placeholders intended for the browser can be sent back to the server and expanded into real environment secret values inside helper payloads. A confirmed echo path exists in the default weather helper that accepts INIT_WEATHER from the socket, copies config.instanceId from the attacker-controlled payload, attempts to dynamically load the requested weather provider, catches errors, and sends WEATHER_ERROR with the same instanceId back to the namespace.
We recommend you to update MagicMirror to version 2.37.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]