Improper handling of multiline messages in node-irc affects matrix-appservice-irc

CAO 8.8CVE-2022-29166 · GHSA-37hr-348p-rmf4 · Công bố 05/05/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-29166 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng matrix irc bridge (matrix), matrix-appservice-irc.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 63.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.33.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
matrix irc bridge matrix	`< 0.33.2`	`0.33.2`
matrix-appservice-irc npm	`< 0.33.2`	`0.33.2`

Mô tả

matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. In terms of a workaround, users should refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms.

Mô tả của NVD

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue.