GitHub Advisoryadvisory · npm
GHSA-52rh-5rpj-c3w6 Improper handling of multiline messages in node-irc
HIGH
Official page ↗
- Ecosystem
- npm
- Packages
- matrix-org-irc
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-74, CWE-93
- Reviewed
- 2022-05-05
Affected packages
• npm matrix-org-irc: < 1.2.1 → fixed in 1.2.1
Description
node-irc is a socket wrapper for the IRC protocol that extends Node.js' EventEmitter. The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of the message be sent to the IRC server verbatim rather than as a message to the channel.
The vulnerability has been patched in node-irc version 1.2.1.
Related
References
- https://github.com/matrix-org/node-irc/security/advisories/GHSA-52rh-5rpj-c3w6 web
- https://nvd.nist.gov/vuln/detail/CVE-2022-29166 advisory
- https://github.com/matrix-org/node-irc/commit/2976c856df37660a9d664e94c857c796de2e34f7 web
- https://github.com/matrix-org/node-irc/commit/e3eb9c15f8240e9c92365f5ffc3944469229771b web
- https://github.com/matrix-org/node-irc package
- https://matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity web