CVE-2025-27146: Matrix IRC Bridge Command Injection Vulnerability
Summary
CVE-2025-27146: Matrix IRC Bridge allows IRC command injection to own puppeted user. Affects matrix-appservice-irc versions < 3.0.4. Fixed in 3.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The matrix-appservice-irc package is an integration bridge that allows communication between Matrix and IRC networks. It enables users to interact with IRC channels as if they were part of the Matrix ecosystem. This package is widely used for bridging chat services, allowing seamless communication across different platforms. However, it has a vulnerability that can be exploited to execute arbitrary IRC commands as the puppeted user, posing a security risk.
Vulnerability Detail
The vulnerability in the matrix-appservice-irc bridge, present in versions up to 3.0.3, allows an attacker to inject arbitrary IRC commands that are executed under the context of the puppeted user. This means that while the attacker can only execute commands as their own IRC user, it can lead to unauthorized actions and potential misuse of the IRC account. The root cause of this issue stems from improper validation and sanitization of user inputs, which allows command injection attacks to succeed.
How To Fix
Latest published version: 0.36.1 as of 23 Oct 2026
npm install matrix-appservice-irc@0.36.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.4
This is the first release that contains the fix.
npm install matrix-appservice-irc@3.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the permissions of the IRC users or limit the commands that can be executed through the bridge until the package is updated. However, the best solution is to apply the patch as soon as possible.
Conclusion
The matrix-appservice-irc package has a critical vulnerability that allows command injection as the puppeted user. It is crucial to update to version 3.0.4 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for matrix-appservice-irc →
FAQ
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
Yes, if your application is using an affected version of the matrix-appservice-irc package, your IRC account could be compromised.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider implementing strict access controls and monitoring for unusual activity on your IRC accounts.
For more information, you can contact the security team at security@matrix.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-appservice-irc.
