CVE-2026-63640: MagicMirror socket payload secret placeholder expansion

CVE-2026-63640 · Severity: medium · CVSS 4.3 · Published 2026-08-18

MagicMirror is a modular display platform that supports Socket.IO-based communication between modules. When the hideConfigSecrets feature is enabled to protect sensitive environment variables, the application incorrectly expands SECRET_* placeholder references in inbound socket messages. An attacker with access to a module namespace can send specially crafted messages containing placeholders like **SECRET_API_KEY** to retrieve the actual environment variable values and potentially leak API tokens, credentials, or other secrets stored in the server configuration.

Technologies: MagicMirrorOrg MagicMirror², magicmirror (npm). Vendors: MagicMirrorOrg, npm.

Quick answers

Is CVE-2026-63640 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63640 being exploited in the wild.
How severe is CVE-2026-63640?
Medium severity, with a CVSS score of 4.3, published 18 August 2026.
Which products and versions are affected?
MagicMirrorOrg MagicMirror² <2.37.0; magicmirror (npm) SEMVER:introduced=0,fixed=2.37.0.
Is there a fix for CVE-2026-63640?
Yes. magicmirror (npm): upgrade to 2.37.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63640 attacked?
It is attacked from the adjacent network or over the network, in a software library.
Am I affected by CVE-2026-63640?
Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • magicmirror (npm): upgrade to 2.37.0 or later
    npm install magicmirror@2.37.0

Technical details

The vulnerability exists in the Socket.IO message dispatcher within js/node_helper.js, which calls replaceSecretPlaceholder() on every inbound socket payload to expand **SECRET_*** placeholders into their real environment variable values before passing data to module handlers. Although the /config HTTP endpoint correctly redacts these placeholders when hideConfigSecrets: true is set, the socket dispatcher reverses this boundary by re-expanding them in inbound client messages. The root cause is in js/server_functions.js:23-34, which replaces **SECRET_NAME** patterns with process.env[...] values. An unauthenticated attacker with network access to a Socket.IO module namespace can craft payloads containing known or guessed SECRET_* variable names. Default module helpers like the weather module echo attacker-controlled fields in error responses, enabling secret exfiltration. The vulnerability requires knowledge of the SECRET_* variable name and depends on network reachability to the Socket.IO service. Fixed in version 2.37.0 by removing placeholder expansion from inbound socket payloads.

Affected products

  • MagicMirrorOrg MagicMirror <2.37.0

Identifiers

  • CVE-2026-63640
  • GHSA-q4gh-4ffp-5cg8

Timeline

  • 2026-07-01: disclosed
  • 2026-07-01: patched: Patched in version 2.37.0
  • 2026-08-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.