matrix-appservice-irc IRC command injection via admin commands containing newlines
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | matrix-appservice-irc | before 1.0.1 | 1.0.1 | Patch available | CNA |
| — | matrix-appservice-irc (npm) | before 1.0.1 | 1.0.1 | Patch available | GHSA-3pmj-jqqp-2mj3 |
- matrix-appservice-irc Vendormatrix-org Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
- matrix-appservice-irc (npm) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-3pmj-jqqp-2mj3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:* | before 1.0.1 | Vulnerable | matrix-org |
- cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:* Versions before 1.0.1 Vulnerable ·matrix-org
Remediation
- Fix · CNA matrix-appservice-irc (matrix-org) Fixed in 1.0.1
- Fix · GHSA-3pmj-jqqp-2mj3 matrix-appservice-irc (npm) Fixed in 1.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-38690
- 2026-10-03 Alias added: GHSA-3pmj-jqqp-2mj3
References
Patch 1
Advisory 2
More matrix-org Matrix Irc Bridge vulnerabilities
- TI-2022-18583 Parsing issue in matrix-org/node-irc leading to room takeovers CVSS 3.1HIGH 8.8
- TI-2022-11710 Improper handling of multiline messages in matrix-appservice-irc CVSS 3.1HIGH 8.8
- TI-2022-18582 IRC mode parameter confusion in matrix-appservice-irc CVSS 3.1MEDIUM 6.3
- TI-2022-03640 matrix-appservice-irc PgDataStore.ts sql injection CVSS 3.1MEDIUM 5.6
- TI-2025-20003 Matrix IRC Bridge allows IRC command injection to own puppeted user CVSS 3.1MEDIUM 4.3
- TI-2023-20048 matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms CVSS 3.1LOW 3.7
Sources
- CVE-2023-38690 · CVE Program
- CVE-2023-38690 · NVD
- FIRST EPSS
- GHSA-3pmj-jqqp-2mj3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences