CVE-2026-63642

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.

• CWE-918

• https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f
• https://github.com/MagicMirrorOrg/MagicMirror/pull/4169
• https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0
• https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g
• https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63637Dgraph is an open source distributed GraphQL database. Prior…8.6
• CVE-2026-63638OpenImageIO is a toolset for reading, writing, and manipulat…8.3
• CVE-2026-63639Valkey is a distributed key-value database. Prior to 7.2.14,…8.8
• CVE-2026-6364Out of bounds read in Skia in Google Chrome prior to 147.0.7…6.5
• CVE-2026-63640MagicMirror² is an open source modular smart mirror platform…4.3
• CVE-2026-63641MagicMirror² is an open source modular smart mirror platform…2.3
• CVE-2026-63643MagicMirror² is an open source modular smart mirror platform…6.3
• CVE-2026-63645OpenObserve is a cloud-native observability platform. Prior …7.5
• CVE-2026-63646CordysCRM is an open source AI-powered customer relationship…6.9
• CVE-2026-63647CordysCRM is an open source AI-powered customer relationship…9.3
• CVE-2026-63649The Windows interactive service in OpenVPN 2.4.0 through 2.6…4.1
• CVE-2026-6365Improper Neutralization of Input During Web Page Generation …6.1