CVE-2025-27146 Matrix IRC Bridge allows IRC command injection to own puppeted user

What is CVE-2025-27146?

CVE-2025-27146 is a low-severity command injection vulnerability in matrix-org matrix-appservice-irc, published on 25 Feb 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.

Weakness: CWE-88, CWE-77

Which versions are affected by CVE-2025-27146?

2 open source packages ship an affected version, including matrix-appservice-irc. It affects 1 product.

Products include Matrix Matrix Irc Bridge.

How do I fix CVE-2025-27146?

Upgrade matrix-appservice-irc to 3.0.4 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-27146 being exploited?

There is no known exploitation of CVE-2025-27146 in the wild and no public exploit code.

Other vulnerabilities in matrix-org matrix-appservice-irc

• CVE-2022-39203 Parsing issue in matrix-org/node-irc leading to room takeovers High 8.8
• CVE-2022-29166 Improper handling of multiline messages in matrix-appservice-irc High 8.0
• CVE-2023-38690 matrix-appservice-irc IRC command injection via admin commands containing newlines Medium 5.8
• CVE-2022-3971 matrix-appservice-irc PgDataStore.ts sql injection Medium 4.6
• CVE-2022-39202 IRC mode parameter confusion in matrix-appservice-irc Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5mvm-89c9-9gm5.