Parsing issue in matrix-org/node-irc leading to room takeovers

Description

Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel.

Recommendation

Update the matrix-appservice-irc package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.35.0
• Patched version(s): 0.35.0

References

• GHSA-xvqg-mv25-rwvw
• matrix.org
• CVE-2022-39203
• CWE-269
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• angular vulnerable to super-linear runtime due to backtracking - CVE-2024-21490
• Matrix IRC Bridge allows IRC command injection to own puppeted user - CVE-2025-27146
• Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772
• Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362

Tags:

npm

matrix-appservice-irc