Security: MagicMirrorOrg/MagicMirror
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variablesGHSA-q4gh-4ffp-5cg8 published
Jul 1, 2026 by KristjanESPERANTOModerate -
MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actionsGHSA-w26r-fwg8-rcp3 published
Jul 1, 2026 by KristjanESPERANTOLow -
Blind Server Side Request Forgery (SSRF)GHSA-998g-7v5w-cr7g published
Jul 1, 2026 by KristjanESPERANTOModerate -
SSRF via `ADD_CALENDAR` (MagicMirror² calendar)GHSA-w6x9-28jw-hq7j published
Jul 1, 2026 by KristjanESPERANTOHigh -
Unauthenticated SSRF via /cors endpointGHSA-ph6f-2cvq-79hq published
Apr 30, 2026 by KristjanESPERANTOCritical