~ / search / GHSA-5mvm-89c9-9gm5

GHSA-5mvm-89c9-9gm5

Matrix IRC Bridge allows IRC command injection to own puppeted user

Source: GitHub Advisory Database (reviewed) Low CVE-2025-27146

Packages

EcosystemPackageAffectedFixed in
npm matrix-appservice-irc < 3.0.4 3.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. ### Patches The vulnerability has been patched in matrix-appservice-irc version 3.0.4. ### For more information If you have any questions or comments about this advisory, please email us at [security at matrix.org](mailto:[email protected]).

References

External links from the advisory. They lead to third-party sites.