{"items":[{"id":"NVI-00015189","kind":"vulnerability","title":"MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-q4gh-4ffp-5cg8","CVE-2026-63640"],"plain_summary":"GitHub lists this reviewed advisory for magicmirror. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-395bd14b806e13f6551f3543cb85d8c8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-18T18:00:19.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-395bd14b806e13f6551f3543cb85d8c8"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-395bd14b806e13f6551f3543cb85d8c8","url":"https://github.com/advisories/GHSA-q4gh-4ffp-5cg8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-q4gh-4ffp-5cg8","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:15:44.568Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-395bd14b806e13f6551f3543cb85d8c8"],"technology":"magicmirror","known_exclusions":[],"conditions_summary":"### Summary\nWhen `hideConfigSecrets: true` is enabled, MagicMirror redacts `SECRET_*` environment placeholders in the HTTP `/config` response, but the shared node-helper socket dispatcher expands `**SECRET_NAME**` placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as `**SECRET_API_KEY**` and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can return the secret value to the socket client.\n\n### Details\nThe affected product is the npm package/application `magicmirror` at version `2.36.0`, tested at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8` from `https://github.com/MagicMirrorOrg/MagicMirror.git`.\n\nThe secret-redaction feature is implemented during config loading:\n\n- `js/utils.js:117-123` loads a `config.env` file next to the config file into `process.env` when present.\n- `js/utils.js:130-151` creates both a full config and a redacted config.\n- `js/utils.js:137-140` redacts environment variables whose names start with `SECRET_`","public_affected_ranges":["< 2.37.0"]}],"null_published_at":"2026-11-03T10:03:26.558Z","source_updated_at":"2026-08-18T18:00:19.000Z","source_disclosed_at":"2026-08-18T18:00:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:15:44.568Z"}],"next_cursor":null,"snapshot_revision":"42594"}