THREAT OPS › Threat News › [GHSA] GHSA-w6x9-28jw-hq7j (medium) — MagicMirror: ssrf calendar .js
[GHSA] GHSA-w6x9-28jw-hq7j (medium) — MagicMirror: ssrf calendar .js
GHSA-w6x9-28jw-hq7j Severity: medium CVE: CVE-2026-63643
MagicMirror: ssrf calendar .js
# Vulnerability — SSRF via `ADD_CALENDAR` (MagicMirror² calendar)
> Analysis of the PoC `exploit-ssrf-calendar.js`. > Target: `calendar/node_helper.js` of MagicMirror², socket.io namespace `/calendar`.
---
## Identification
| Field | Value | |-------|-------| | **PoC file** | `exploit-ssrf-calendar.js` |
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-63643cve
- http://TARGET:8888url
- https://webhook.site/url
- socket.iodomain
Original source: https://github.com/advisories/GHSA-w6x9-28jw-hq7j