A bug in MagicMirror² allows a client connected to a loaded module namespace to submit a placeholder for a secret key, such as SECRET_API_KEY. When the server processes the inbound socket payload, it expands the placeholder using the process environment, and an echo path is provided via the weather helper’s error response. This effectively reverses the intended one‑way redaction boundary, revealing API tokens, credentials, or service keys that are stored in SECRET_ environment variables. The vulnerability results in the unintended disclosure of configuration secrets to an attacker who can influence or observe socket traffic.

MagicMirror by MagicMirrorOrg is affected. The flaw exists in any installation of MagicMirror that uses a version prior to 2.37.0 where the setting hideConfigSecrets is enabled. Version 2.37.0 and later contain the fix and are not impacted.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available, so current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be able to send crafted socket notifications to a module’s namespace, which can be achieved if the module is reachable from an external network or an untrusted internal client. Once the placeholder is submitted, the server expands it and returns the secret in a response, allowing the attacker to read the environment variable value. The exploit does not require privileged access on the host, but requires network or local access to the MagicMirror instance.