CVE-2026-63641

MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

In a documented common non-loopback deployment that relies on ipWhitelist for access control, an unauthenticated network client can bypass the intended IP allowlist for Socket.IO module namespaces. The attacker can send arbitrary module-helper notifications and payloads as if they were a trusted browser client.

Confirmed impacts include:

• Confidentiality/SSRF: server-side requests to attacker-chosen URLs through default module helpers, including loopback/internal URLs. The newsfeed PoC shows a HEAD request to 127.0.0.1.
• Integrity/availability: arbitrary manipulation of module-helper state and periodic fetch/update behavior through trusted socket messages.
• Conditional code execution: when a third-party git-managed module is considered behind by the update checker, an attacker can supply a command in the socket CONFIG payload and trigger child_process.exec; the PoC safely wrote a /tmp marker.

CVSS 3.1 rationale for the primary trust-boundary bypass with confirmed SSRF and conditional RCE variant: AV:A because MagicMirror's security policy says it is intended for trusted local/private networks and the documented non-loopback exposure is LAN-style; AC:H because default loopback settings must be changed and the RCE variant requires a pending third-party module update, though SSRF requires fewer conditions after reachability; PR:N because no application authentication is required; UI:N because the attacker connects directly to Socket.IO; S:C because the vulnerable application can cause requests/actions against other local/internal services and can execute commands in a child process in the conditional variant; C:L/I:L/A:L for confirmed internal request and helper-state/command side effects, with conservative scoring because unconditional default RCE was not shown.

Kodem intelligence

Already deployed Kodem?

1. What is CVE-2026-63641? CVE-2026-63641 is a low-severity security vulnerability in magicmirror (npm), affecting versions < 2.37.0. It is fixed in 2.37.0.
2. Which versions of magicmirror are affected by CVE-2026-63641? magicmirror (npm) versions < 2.37.0 is affected.
3. Is there a fix for CVE-2026-63641? Yes. CVE-2026-63641 is fixed in 2.37.0. Upgrade to this version or later.
4. Is CVE-2026-63641 exploitable, and should I be worried? Whether CVE-2026-63641 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-63641 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-63641? Upgrade magicmirror to 2.37.0 or later.

Other vulnerabilities in magicmirror