CVE-2025-27146: Matrix IRC Bridge allows IRC command injection to own puppeted user
Impact The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user.
Patches The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
For more information If you have any questions or comments about this advisory, please email us at security at matrix.org.
Other sources
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/matrix-appservice-ircto a version that resolves this vulnerability.Fixed in 3.0.4 - Upgrade
Upgrade
matrix-appservice-ircto a version that resolves this vulnerability.Fixed in 3.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27146?
CVE-2025-27146 is rated as a high severity vulnerability due to its potential for arbitrary command execution.
How do I fix CVE-2025-27146?
To fix CVE-2025-27146, upgrade to matrix-appservice-irc version 3.0.4 or later.
What can an attacker do with CVE-2025-27146?
An attacker can inject arbitrary IRC commands that are executed as their own IRC user.
Which versions of matrix-appservice-irc are affected by CVE-2025-27146?
Versions of matrix-appservice-irc up to 3.0.3 are affected by CVE-2025-27146.
Is there a workaround for CVE-2025-27146?
There is no official workaround; the best course of action is to apply the patch by updating to version 3.0.4.