CVE-2022-29166 HIGH

CVE-2022-29166: Improper handling of multiline messages in matrix-appservice-irc

Vendor Matrix-Org
Product matrix-appservice-irc
Weakness CWE-74
Published May 5, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

8.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

May 5, 2022 CVE published
April 23, 2025 Record updated