In MagicMirror version 2.37.0 and earlier, the newsfeed module’s node helper accepts a CHECK_ARTICLE_URL notification from the unauthenticated /newsfeed Socket.IO namespace. The helper blindly performs a fetch(url, { method: "HEAD" }) on the attacker‑supplied URL and returns an ARTICLE_URL_STATUS packet containing the URL and the result of the framing test. Because the URL is not validated and the response includes timing information, an adversary can use this pathway to send HEAD requests to internal hosts, discover active services or ports, and trigger side effects on services that react to HEAD requests. The flaw constitutes a blind SSRF that can expose internal network information and potentially affect services behind network firewalls.

The vulnerability exists in every installation of MagicMirrorOrg:MagicMirror prior to v2.37.0. All affected releases lack input validation in the newsfeed module and therefore expose the potential blind SSRF to any user who can reach the /newsfeed Socket.IO endpoint.

The CVSS score of 6.3 indicates a moderate severity, and the EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated web connection to the newsfeed Socket.IO namespace. If an attacker obtains network-level access to the mirror host—directly or via a client that can connect to the Socket.IO endpoint—they can trigger the blind SSRF and probe internal services. Organizations with an exposed newsfeed module or without network segmentation are at higher risk, while internal isolation and strict firewall rules can reduce the potential impact.