PT-2026-37258 · Magicmirrororg+2 · Magicmirror

Astaruf · Published 2026-05-05 · Updated 2026-05-14 · CVE-2026-42281

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.36.0

Description An unauthenticated Server-Side Request Forgery (SSRF) exists in the '/cors' endpoint, which acts as an open HTTP proxy without authentication or URL validation. This allows remote attackers to force the server to perform arbitrary HTTP requests to localhost services, cloud metadata services, and internal networks. The issue is located in the cors() function within js/server functions.js. Additionally, the replaceSecretPlaceholder() function expands environment variable placeholders using the **VAR NAME** pattern, which enables the exfiltration of server-side secrets such as API keys, tokens, and database credentials from process.env.

Recommendations Update MagicMirror² to version 2.36.0. As a temporary workaround, restrict access to the '/cors' endpoint to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-42281

GHSA-PH6F-2CVQ-79HQ

Affected Products

Magicmirror

References · 6

• 🔥 https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-ph6f-2cvq-79hq · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42281 · Security Note
• https://osv.dev/vulnerability/GHSA-ph6f-2cvq-79hq · Vendor Advisory
• https://github.com/MagicMirrorOrg/MagicMirror · Note
• https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.36.0 · Note
• https://t.me/CVEtracker/53787 · Telegram Post