matrix-appservice-irc IRC command injection via admin commands containing newlines

Description

It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot.

Recommendation

Update the matrix-appservice-irc package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.0.0
• Patched version(s): 1.0.1

References

• GHSA-3pmj-jqqp-2mj3
• CVE-2023-38690
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Matrix-appservice-irc vulnerable to sql injection via roomIds argument - CVE-2022-3971
• Matrix IRC Bridge allows IRC command injection to own puppeted user - CVE-2025-27146
• matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
• Improper handling of multiline messages in node-irc affects matrix-appservice-irc - CVE-2022-29166

Tags:

npm

matrix-appservice-irc