CVE-2026-63640

### Summary When `hideConfigSecrets: true` is enabled, MagicMirror redacts `SECRET_*` environment placeholders in the HTTP `/config` response, but the shared node-helper socket dispatcher expands `**SECRET_NAME**` placeholders in every inbound socket payload before passing it to module helpers. Any client that can connect to a loaded module namespace can send a placeholder such as `**SECRET_API_KEY**` and cause the server to substitute the real environment variable into the helper payload. Helpers that echo attacker-controlled payload fields, such as the default weather helper error path, can return the secret value to the socket client. ### Details The affected product is the npm package/application `magicmirror` at version `2.36.0`, tested at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8` from `https://github.com/MagicMirrorOrg/MagicMirror.git`. The secret-redaction feature is implemented during config loading: - `js/utils.js:117-123` loads a `config.env` file next to the config file into `process.env` when present. - `js/utils.js:130-151` creates both a full config and a redacted config. - `js/utils.js:137-140` redacts environment variables whose names start with `SECRET_` to `**SECRET_NAME**` in the redacted config when `hideConfigSecrets: true` is present. - `js/server.js:112-125` returns either `configObj.redactedConf` or `configObj.fullConf` from `/config` depending on `config.hideConfigSecrets`. The disclosure root cause is the inbound socket dispatcher: - `js/node_helper.js:88-103` registers a catch-all handler for each module namespace. - `js/node_helper.js:91-99` checks `config?.hideConfigSecrets` and, for every inbound object payload, runs `replaceSecretPlaceholder(JSON.stringify(payload))` before invoking `socketNotificationReceived(...)`. - `js/server_functions.js:23-34` implements `replaceSecretPlaceholder(...)` by replacing `**SECRET_* **`-style placeholders with `process.env[...]`, unless `global.config.cors === "allowAll"`. This reverses t