matrix-appservice-irc PgDataStore.ts sql injection
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component. VDB-213550 is the identifier assigned to this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| unspecified | matrix-appservice-irc | 0.35.0; 0.35.1 | — | No fix listed | CNA |
| — | matrix-appservice-irc (npm) | before 0.36.0 | 0.36.0 | Patch available | GHSA-ffwf-47x2-jpr8 |
- matrix-appservice-irc Vendorunspecified Affected 0.35.0; 0.35.1 Fixed in — No fix listed CNA
- matrix-appservice-irc (npm) Vendor— Affected before 0.36.0 Fixed in 0.36.0 Patch available GHSA-ffwf-47x2-jpr8
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:* | up to 0.36.0 | Vulnerable | matrix-org |
- cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:* Versions up to 0.36.0 Vulnerable ·matrix-org
Remediation
- Fix · GHSA-ffwf-47x2-jpr8 matrix-appservice-irc (npm) Fixed in 0.36.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3971
- 2026-10-03 Alias added: GHSA-ffwf-47x2-jpr8
References
Patch 2
Advisory 2
More matrix-org Matrix Irc Bridge vulnerabilities
- TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
- TI-2022-18583 Parsing issue in matrix-org/node-irc leading to room takeovers CVSS 3.1HIGH 8.8
- TI-2022-11710 Improper handling of multiline messages in matrix-appservice-irc CVSS 3.1HIGH 8.8
- TI-2022-18582 IRC mode parameter confusion in matrix-appservice-irc CVSS 3.1MEDIUM 6.3
- TI-2025-20003 Matrix IRC Bridge allows IRC command injection to own puppeted user CVSS 3.1MEDIUM 4.3
- TI-2023-20048 matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms CVSS 3.1LOW 3.7
Sources
- CVE-2022-3971 · CVE Program
- CVE-2022-3971 · NVD
- FIRST EPSS
- GHSA-ffwf-47x2-jpr8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences