Parsing issue in matrix-org/node-irc leading to room takeovers

Description

Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel.

Recommendation

Update the matrix-appservice-irc package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.35.0
• Patched version(s): 0.35.0

References

• GHSA-xvqg-mv25-rwvw
• matrix.org
• CVE-2022-39203
• CWE-269
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Matrix IRC Bridge allows IRC command injection to own puppeted user - CVE-2025-27146
• Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362
• XSS vulnerability that affects bootstrap (GHSA-3mgp-fx93-9xv5) - CVE-2018-20676
• Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to - CVE-2024-39691

Tags:

npm

matrix-appservice-irc