EUVD-2026-61072
GHSA-998g-7v5w-cr7g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint causes scope change by probing internal hosts, yielding low confidentiality impact; no integrity or availability impact on the mirror itself.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.
AnalysisAI
Unauthenticated Server-Side Request Forgery in MagicMirror² versions prior to 2.37.0 allows any network-reachable attacker to weaponize the smart mirror as an internal network probe. By connecting to the unguarded Socket.IO /newsfeed namespace and emitting a CHECK_ARTICLE_URL notification with an attacker-controlled URL, the server performs an unsanitized fetch() HEAD request and returns timing and framing data via ARTICLE_URL_STATUS, creating a boolean-plus-timing oracle for internal host and port enumeration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to reach the MagicMirror² HTTP port (default 8080) over the network - no authentication, credentials, or session token of any kind are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 with AT:P (attack requirement: the attacker must reach the mirror's HTTP port) appropriately moderates the theoretical network-vector severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MagicMirror² to version 2.37.0 or later, which is confirmed as the vendor-released patch per the tagged release at https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0 and the fix commit at https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Magicmirror
View allServer-side request forgery in MagicMirror² versions prior to 2.37.0 allows unauthenticated remote attackers to make the
Socket.IO namespace access control bypass in MagicMirror² prior to v2.37.0 allows unauthenticated adjacent-network clien
Secret environment variable disclosure in MagicMirror² before 2.37.0 allows adjacent network attackers to recover live S
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today