Is CVE-2026-42281 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42281 being exploited in the wild.

How severe is CVE-2026-42281?

High severity, with a CVSS score of 8.6, published 14 May 2026.

Which products and versions are affected?

MagicMirrorOrg MagicMirror² < 2.36.0, <= 2.35.0; magicmirror (npm) SEMVER:introduced=0,fixed=2.36.0.

Is there a fix for CVE-2026-42281?

Yes. magicmirror (npm): upgrade to 2.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42281 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42281?

Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42281: MagicMirrorOrg MagicMirror² SSRF and secret exfiltration in /cors endpoint

Q: Is there a fix for CVE-2026-42281?

Yes. magicmirror (npm): upgrade to 2.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42281 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42281?

Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42281 · Severity: high · CVSS 8.6 · Published 2026-05-14

MagicMirror², a popular open-source smart mirror platform, contains a security flaw in its CORS proxy component. An attacker can use this flaw to force the mirror to access private internal network services or steal sensitive configuration data like API keys and credentials. This could lead to a full compromise of the device or the cloud environment where it is hosted.

Technologies: MagicMirrorOrg MagicMirror², magicmirror (npm). Vendors: MagicMirrorOrg, npm.

Quick answers

Is CVE-2026-42281 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42281 being exploited in the wild.
How severe is CVE-2026-42281?: High severity, with a CVSS score of 8.6, published 14 May 2026.
Which products and versions are affected?: MagicMirrorOrg MagicMirror² < 2.36.0, <= 2.35.0; magicmirror (npm) SEMVER:introduced=0,fixed=2.36.0.
Is there a fix for CVE-2026-42281?: Yes. magicmirror (npm): upgrade to 2.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42281 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42281?: Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

magicmirror (npm): upgrade to 2.36.0 or later
```
npm install magicmirror@2.36.0
```

Technical details

An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the `/cors` endpoint of MagicMirror² within `js/server_functions.js`. The endpoint acts as an open proxy, fetching any user-provided URL via `fetch()` without validation or restriction of IP ranges (e.g., localhost or cloud metadata services). Furthermore, the `replaceSecretPlaceholder()` function automatically expands `**VAR_NAME**` patterns in the requested URL with server-side environment variables, allowing for the exfiltration of secrets like API keys. Attackers can exploit this to scan internal networks, access cloud instance metadata (IMDSv1), or leak credentials. The issue is fixed in version 2.36.0.

Affected products

MagicMirrorOrg MagicMirror² <= 2.35.0

Identifiers

CVE-2026-42281
GHSA-ph6f-2cvq-79hq

Timeline

2026-04-30: disclosed
2026-05-05: advisory
2026-05-05: patched: Fixed in version 2.36.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.