Description

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T18:19:11.800Z",
  "pubdate": "2026-08-18T18:19:11.800Z",
  "executiveSummary": "An information disclosure vulnerability exists in MagicMirror² prior to version 2.37.0 when the hideConfigSecrets configuration is enabled.\nThe vulnerability allows remote clients connected to a loaded module namespace to bypass intended one-way redaction boundaries and retrieve sensitive API tokens, credentials, or service keys stored in process environment variables.\nThe flaw stems from improper handling of inbound object payloads within the catch-all socket dispatcher, which inadvertently reverses the secret placeholder replacement mechanism when combined with specific module handlers like the default weather helper.\nAn attacker with network access to a loaded module namespace can exploit this issue by submitting specific placeholders via socket communication, resulting in the leakage of sensitive environment variables through error echo paths.\nThe risk implication involves unauthorized exposure of confidential authentication materials and backend credentials, potentially leading to unauthorized access to third-party services integrated with the smart mirror platform.\nExploitation requires network connectivity to the MagicMirror² instance and the ability to interact with loaded module namespaces, with the vulnerability being fully resolved in version 2.37.0.",
  "technicalDetails": "The vulnerability resides in the core server logic of MagicMirror², specifically within js/node_helper.js and js/server_functions.js.\nWhen the hideConfigSecrets setting is enabled, the catch-all socket dispatcher located in js/node_helper.js intercepts every inbound object payload received from connected clients.\nPrior to invoking the socketNotificationReceived function, the dispatcher passes the payload through the replaceSecretPlaceholder function defined in js/server_functions.js.\nThis mechanism is intended to protect sensitive data; however, a client connected to a loaded module namespace can manipulate this behavior by submitting a SECRET_API_KEY placeholder.\nUpon receiving this placeholder, the server dynamically replaces it with the corresponding sensitive value retrieved directly from the server's process environment variables.\nThe attack flow is facilitated by vulnerable module implementations, such as the default weather helper.\nThe default weather helper accepts the INIT_WEATHER action, copies the attacker-controlled instanceId parameter, and subsequently returns it within a WEATHER_ERROR response.\nThis behavior establishes an unintended echo path that transmits the newly expanded secret back to the client.\nConsequently, this mechanism reverses the intended one-way redaction boundary, allowing malicious or unauthorized actors to extract confidential API tokens, service keys, and credentials stored within SECRET_ environment variables.\nThe affected component involves the socket communication handling and secret replacement pipeline in versions prior to 2.37.0.\nExploitation requires network exposure to the MagicMirror² interface and interaction capability with a loaded module namespace, but does not inherently require advanced authentication privileges beyond network-level socket access."
}