CVE-2022-39202: matrix-appservice-irc vulnerable to IRC mode parameter confusion
Summary
CVE-2022-39202: matrix-appservice-irc vulnerable to IRC mode parameter confusion. Affects matrix-appservice-irc versions < 0.35.0. Fixed in 0.35.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-appservice-irc is an npm package that provides a bridge between Matrix and IRC networks, allowing users to communicate between the two platforms. It facilitates the integration of IRC networks into Matrix chat rooms, enabling users to send and receive messages across both platforms. However, a vulnerability has been discovered in matrix-appservice-irc that could lead to IRC mode parameter confusion.
Vulnerability Detail
The vulnerability in matrix-appservice-irc arises from the incorrect parsing of multiple modes specified in a single mode command. This issue is due to a bug in the underlying matrix-org/node-irc library. As a result, when multiple modes are used in a single command, the parsing is performed incorrectly, potentially granting incorrect permissions to users. Exploitation of this vulnerability requires the execution of mode commands by privileged users. Therefore, it can only be abused if an operator is tricked into running the command on behalf of an attacker. The impact of this vulnerability can lead to unauthorized access and privilege escalation within the Matrix and IRC networks.
How To Fix
Latest published version: 0.36.1 as of 23 Oct 2026
npm install matrix-appservice-irc@0.36.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.35.0
This is the first release that contains the fix.
npm install matrix-appservice-irc@0.35.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, it is advised to refrain from entering mode commands suggested by untrusted users. Additionally, it is recommended to avoid using multiple modes in a single command to minimize the potential for incorrect parsing and associated vulnerabilities.
Conclusion
The vulnerability in matrix-appservice-irc, which allows for IRC mode parameter confusion, can lead to unauthorized access and privilege escalation. It is crucial to update to matrix-appservice-irc version 0.35.0 or later to address this vulnerability. If immediate updating is not possible, it is recommended to follow the provided workarounds and exercise caution when executing mode commands. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-appservice-irc →
FAQ
matrix-appservice-irc is an npm package that acts as a bridge between Matrix and IRC networks, allowing users to communicate between the two platforms.
The vulnerability in matrix-appservice-irc can result in incorrect parsing of mode commands, potentially granting incorrect permissions to users. This could lead to unauthorized access and privilege escalation within the Matrix and IRC networks.
Exploitation of this vulnerability requires the execution of mode commands by privileged users. An attacker would need to trick an operator into running the command on their behalf.
Yes, the vulnerability has been patched in matrix-appservice-irc version 0.35.0. It is recommended to update to this version or later to mitigate the risk.
If updating to the latest version is not immediately feasible, it is advised to refrain from entering mode commands suggested by untrusted users and avoid using multiple modes in a single command.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-appservice-irc.
