magicmirror
npm · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables | magicmirror | npm | Medium | Fix reported | |
| MagicMirror: ssrf calendar .js | magicmirror | npm | Medium | Fix reported | |
| MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery | magicmirror | npm | Medium | Fix reported | |
| MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions | magicmirror | npm | Low | Fix reported | |
| MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint | magicmirror | npm | Critical | Fix reported |