MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint

Description

An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services.

Recommendation

Update the magicmirror package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.35.0
• Patched version(s): 2.36.0

References

• GHSA-ph6f-2cvq-79hq
• CVE-2026-42281
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass - paperclipai - CVE-2026-41679
• paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass - CVE-2026-41679
• Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint - CVE-2023-46729
• Parse Server vulnerable to user enumeration via email verification endpoint - CVE-2026-31901

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

magicmirror