Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

WS-2022-0128

Good to know:

icon

Date: August 19, 2025

matrix-org-irc versions prior to 1.2.1 are vulnerable to Improper handling of multiline messages which could lead to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of the message be sent to the IRC server verbatim rather than as a message to the channel

Language: TYPE_SCRIPT

Severity Score

Related Resources (7)

https://github.com/matrix-org/node-irc/commit/e3eb9c15f8240e9c92365f5ffc3944469229771b
https://matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity
https://github.com/matrix-org/node-irc/commit/2976c856df37660a9d664e94c857c796de2e34f7
https://github.com/matrix-org/node-irc/commit/a6552e52ed11342bc44f9150899d65168d6cf9ec
https://github.com/matrix-org/node-irc
https://github.com/matrix-org/node-irc/security/advisories/GHSA-52rh-5rpj-c3w6
https://www.mend.io/vulnerability-database/WS-2022-0128

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): LOW

Do you need more information?

Contact Us