CVE-2026-63640: MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRETAPIKEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INITWEATHER, copies the attacker-controlled instanceId, and returns it in WEATHERERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET variables. This issue is fixed in version 2.37.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MagicMirror²to a version that resolves this vulnerability.Fixed in 2.37.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Systems running MagicMirror² before 2.37.0 are affected when hideConfigSecrets is enabled and secrets are present in process environment variables whose names begin with SECRET_. Exposure requires that an attacker can connect as a client to a loaded module namespace.
What does an attacker need to do to retrieve a secret?
No authentication, user interaction, or complex exploitation conditions are described. An attacker sends an object payload containing a placeholder such as SECRET_API_KEY; the socket dispatcher expands it before passing it to the module, and the weather helper can echo the attacker-controlled instanceId in a WEATHER_ERROR response.
What is the remediation?
Upgrade MagicMirror² to version 2.37.0, which fixes the issue. The provided data does not describe an alternative mitigation for systems that cannot yet be patched.
How can I determine whether my deployment is affected?
Review whether a client connected to a loaded module namespace can send a SECRET_* placeholder and receive its expanded value through a module response such as WEATHER_ERROR. Also identify SECRET_ environment variables available to the MagicMirror² process, as those are the values at risk of disclosure.