Matrix IRC Bridge allows IRC command injection to own puppeted user

TRUNG BÌNH 4.3CVE-2025-27146 · GHSA-5mvm-89c9-9gm5 · Công bố 25/02/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-27146 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng matrix irc bridge (matrix), matrix-appservice-irc.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.40%, cao hơn 33.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.0.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
matrix irc bridge matrix	`< 3.0.4`	`3.0.4`
matrix-appservice-irc npm	`< 3.0.4`	`3.0.4`

Mô tả

Impact

The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user.

Patches

The vulnerability has been patched in matrix-appservice-irc version 3.0.4.

For more information

If you have any questions or comments about this advisory, please email us at security at matrix.org.

Mô tả của NVD

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.