Improper handling of multiline messages in node-irc affects matrix-appservice-irc

Description

matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2.

Recommendation

Update the matrix-appservice-irc package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.33.1
• Patched version(s): 0.33.2

References

• GHSA-37hr-348p-rmf4
• matrix.org
• CVE-2022-29166
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components - CVE-2025-1647
• Matrix IRC Bridge allows IRC command injection to own puppeted user - CVE-2025-27146
• Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
• Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to - CVE-2024-39691

Tags:

npm

matrix-appservice-irc