Executive brief
MagicMirror is a modular display platform that supports Socket.IO-based communication between modules. When the hideConfigSecrets feature is enabled to protect sensitive environment variables, the application incorrectly expands SECRET_* placeholder references in inbound socket messages. An attacker with access to a module namespace can send specially crafted messages containing placeholders like **SECRET_API_KEY** to retrieve the actual environment variable values and potentially leak API tokens, credentials, or other secrets stored in the server configuration.
Technical details
The vulnerability exists in the Socket.IO message dispatcher within js/node_helper.js, which calls replaceSecretPlaceholder() on every inbound socket payload to expand **SECRET_*** placeholders into their real environment variable values before passing data to module handlers. Although the /config HTTP endpoint correctly redacts these placeholders when hideConfigSecrets: true is set, the socket dispatcher reverses this boundary by re-expanding them in inbound client messages. The root cause is in js/server_functions.js:23-34, which replaces **SECRET_NAME** patterns with process.env[...] values. An unauthenticated attacker with network access to a Socket.IO module namespace can craft payloads containing known or guessed SECRET_* variable names. Default module helpers like the weather module echo attacker-controlled fields in error responses, enabling secret exfiltration. The vulnerability requires knowledge of the SECRET_* variable name and depends on network reachability to the Socket.IO service. Fixed in version 2.37.0 by removing placeholder expansion from inbound socket payloads.
Affected products
- MagicMirrorOrg MagicMirror <2.37.0
Timeline
- 2026-07-01: disclosed
- 2026-07-01: patched: Patched in version 2.37.0
- 2026-08-18: advisory