Parsing issue in matrix-org/node-irc leading to room takeovers

Description

Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel.

Recommendation

Update the matrix-appservice-irc package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.35.0
• Patched version(s): 0.35.0

References

• GHSA-xvqg-mv25-rwvw
• matrix.org
• CVE-2022-39203
• CWE-269
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Improper handling of multiline messages in node-irc affects matrix-appservice-irc - CVE-2022-29166
• Matrix-appservice-irc vulnerable to sql injection via roomIds argument - CVE-2022-3971
• matrix-appservice-irc vulnerable to IRC mode parameter confusion - CVE-2022-39202
• Matrix IRC Bridge allows IRC command injection to own puppeted user - CVE-2025-27146

Tags:

npm

matrix-appservice-irc