Matrix IRC Bridge allows IRC command injection to own puppeted user
Priority LOW 20CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Fix Fixed matrix-appservice-irc (matrix-org): 3.0.4matrix-appservice-irc (npm): 3.0.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | matrix-appservice-irc | before 3.0.4 | 3.0.4 | Patch available | CNA |
| — | matrix-appservice-irc (npm) | before 3.0.4 | 3.0.4 | Patch available | GHSA-5mvm-89c9-9gm5 |
- matrix-appservice-irc Vendormatrix-org Affected before 3.0.4 Fixed in 3.0.4 Patch available CNA
- matrix-appservice-irc (npm) Vendor— Affected before 3.0.4 Fixed in 3.0.4 Patch available GHSA-5mvm-89c9-9gm5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:* | before 3.0.4 | Vulnerable | matrix-org |
- cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:* Versions before 3.0.4 Vulnerable ·matrix-org
Remediation
- Fix · CNA matrix-appservice-irc (matrix-org) Fixed in 3.0.4
- Fix · GHSA-5mvm-89c9-9gm5 matrix-appservice-irc (npm) Fixed in 3.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27146
- 2026-10-03 Alias added: GHSA-5mvm-89c9-9gm5
References
Patch 1
Advisory 2
More matrix-org Matrix Irc Bridge vulnerabilities
- TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
- TI-2022-18583 Parsing issue in matrix-org/node-irc leading to room takeovers CVSS 3.1HIGH 8.8
- TI-2022-11710 Improper handling of multiline messages in matrix-appservice-irc CVSS 3.1HIGH 8.8
- TI-2022-18582 IRC mode parameter confusion in matrix-appservice-irc CVSS 3.1MEDIUM 6.3
- TI-2022-03640 matrix-appservice-irc PgDataStore.ts sql injection CVSS 3.1MEDIUM 5.6
- TI-2023-20048 matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms CVSS 3.1LOW 3.7
Sources
- CVE-2025-27146 · CVE Program
- CVE-2025-27146 · NVD
- FIRST EPSS
- GHSA-5mvm-89c9-9gm5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences