CVE-2026-63642
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability in checkArticleUrl in defaultmodules/newsfeed/node_helper.js that accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.
Risk Assessment
The risk includes internal network scanning and service identification, potentially facilitating further attacks.
Recommendation
It is recommended to upgrade MagicMirror² to version 2.37.0 or later and restrict access to Socket.IO namespaces.
Original NVD description (English source)
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.