GitHub Advisoryadvisory · npm

GHSA-37hr-348p-rmf4 Improper handling of multiline messages in node-irc affects matrix-appservice-irc

HIGH Published 2022-05-23 Modified 2022-05-23 Official page ↗
Aliases
CVE-2022-29166
Ecosystem
npm
Packages
matrix-appservice-irc
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2022-05-23

Affected packages

• npm matrix-appservice-irc: < 0.33.2 → fixed in 0.33.2

Description

matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. In terms of a workaround, users should refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms.

Related

Alias · CVE (1)

  • CVE-2022-29166 matrix-appservice-irc is a Node.js IRC bridge for Matrix. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References