CVE-2026-63643 MagicMirror: ssrf calendar .js

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADDCALENDAR handler in defaultmodules/calendar/nodehelper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handle...

CVE-2026-63643

Prior to 2.37.0, MagicMirror²'s unauthenticated Socket.IO /calendar namespace passes attacker-controlled URLs to CalendarFetcher without SSRF validation or TLS verification, enabling internal-service response exfiltration and blind request/timing primitives. Upgrade to version 2.37.0 to remediate...