The ADD_CALENDAR handler in MagicMirror's defaultmodules/calendar/node_helper.js accepts an attacker‑controlled URL, authentication data, and selfSignedCert option through the unauthenticated Socket.IO namespace /calendar. These inputs are passed directly to CalendarFetcher without server‑side request forgery validation or TLS verification checks. An attacker can therefore trigger outbound HTTP(S) requests to arbitrary internal or external destinations, potentially retrieving iCal data. When a valid iCal response is received, the CALENDAR_EVENTS endpoint returns the parsed event data back to the attacker, allowing internal‑service response data to be exfiltrated. Even responses that are not valid iCal still provide a blind timing or response primitive, which can aid in probing internal networks.

MagicMirror open‑source modular smart mirror platform from MagicMirrorOrg. Versions prior to 2.37.0 are affected; version 2.37.0 and later contain the fix.

The CVSS score of 6.3 indicates moderate severity. EPSS is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV. The attack vector is external, via an unauthenticated Socket.IO namespace. An attacker with network reach to the Socket.IO endpoint can supply any URL and potentially reach internal resources or extract calendar data. The lack of authentication and absence of SSRF safeguards make exploitation relatively straightforward for a competent attacker, although the impact is limited to data exposure rather than denial of service or remote code execution.