https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-02T03:31:01.113348+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-63640 fkie_cve-2026-63640 2026-10-02T03:31:01.132207+00:00

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.

 https://db.gcve.eu/vuln/ghsa-q4gh-4ffp-5cg8 GHSA-q4gh-4ffp-5cg8 — MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables 2026-10-02T03:31:01.132289+00:00

Affected: npm: magicmirror

### Summary When `hideConfigSecrets: true` is enabled, MagicMirror redacts `SECRET_*` environment placeholders in the HTTP `/config` response, but the shared node-helper socket dispatcher expands `**SECRET_NAME**` placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as `**SECRET_API_KEY**` and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can return the secret value to the socket client.

### Details The affected product is the npm package/application `magicmirror` at version `2.36.0`, tested at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8` from `https://github.com/MagicMirrorOrg/MagicMirror.git`.

The secret-redaction feature is implemented during config loading:

- `js/utils.js:117-123` loads a `config.env` file next to the config file into `process.env` when present. - `js/utils.js:130-151` creates both a full config and a redacted config. - `js/utils.js:137-140` redacts environment variables whose names start with `SECRET_` to `**SECRET_NAME**` in the redacted config when `hideConfigSecrets: true` is present. - `js/server.js:112-125` returns either `configObj.redactedConf` or `configObj.fullConf` from `/config` depending on `config.hideConfigSecrets`.

The disclosure root cause is the inbound socket dispatcher:

- `j…