https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 03:31:04 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-63640 <p>MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.</p> <p>MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-63640 https://db.gcve.eu/vuln/ghsa-q4gh-4ffp-5cg8 <p><strong>Affected:</strong> npm: magicmirror</p> <p>### Summary When `hideConfigSecrets: true` is enabled, MagicMirror redacts `SECRET_*` environment placeholders in the HTTP `/config` response, but the shared node-helper socket dispatcher expands `**SECRET_NAME**` placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as `**SECRET_API_KEY**` and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can return the secret value to the socket client.</p> <p>### Details The affected product is the npm package/application `magicmirror` at version `2.36.0`, tested at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8` from `https://github.com/MagicMirrorOrg/MagicMirror.git`.</p> <p>The secret-redaction feature is implemented during config loading:</p> <p>- `js/utils.js:117-123` loads a `config.env` file next to the config file into `process.env` when present. - `js/utils.js:130-151` creates both a full config and a redacted config. - `js/utils.js:137-140` redacts environment variables whose names start with `SECRET_` to `**SECRET_NAME**` in the redacted config when `hideConfigSecrets: true` is present. - `js/server.js:112-125` returns either `configObj.redactedConf` or `configObj.fullConf` from `/config` depending on `config.hideConfigSecrets`.</p> <p>The disclosure root cause is the inbound socket dispatcher:</p> <p>- `j…</p> <p><strong>Affected:</strong> npm: magicmirror</p> <p>### Summary When `hideConfigSecrets: true` is enabled, MagicMirror redacts `SECRET_*` environment placeholders in the HTTP `/config` response, but the shared node-helper socket dispatcher expands `**SECRET_NAME**` placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as `**SECRET_API_KEY**` and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can return the secret value to the socket client.</p> <p>### Details The affected product is the npm package/application `magicmirror` at version `2.36.0`, tested at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8` from `https://github.com/MagicMirrorOrg/MagicMirror.git`.</p> <p>The secret-redaction feature is implemented during config loading:</p> <p>- `js/utils.js:117-123` loads a `config.env` file next to the config file into `process.env` when present. - `js/utils.js:130-151` creates both a full config and a redacted config. - `js/utils.js:137-140` redacts environment variables whose names start with `SECRET_` to `**SECRET_NAME**` in the redacted config when `hideConfigSecrets: true` is present. - `js/server.js:112-125` returns either `configObj.redactedConf` or `configObj.fullConf` from `/config` depending on `config.hideConfigSecrets`.</p> <p>The disclosure root cause is the inbound socket dispatcher:</p> <p>- `j…</p> https://db.gcve.eu/vuln/ghsa-q4gh-4ffp-5cg8