CVE-2026-63643

A flaw was found in MagicMirror². This flaw involves a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to cause the server to make requests to arbitrary domains. Specifically, the ADDCALENDAR handler in the defaultmodules/calendar/nodehelper.js component, accessible via t...

MagicMirror: ssrf calendar .js

Vulnerability — SSRF via ADDCALENDAR MagicMirror² calendar Analysis of the PoC exploit-ssrf-calendar.js. Target: calendar/nodehelper.js of MagicMirror², socket.io namespace /calendar. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-calendar.js | | Endpoint |...