Skip to main content
cve.nowby Sazabi
← npm
npmPackage

matrix-appservice-irc

9 known vulnerabilities (2 high, 5 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 2 high, 5 medium, 2 low
Registry
npm

Advisories 9

  • Matrix IRC Bridge allows IRC command injection to own puppeted user

    Affected: fixed in 3.0.4.

  • CVE-2024-39691Medium 4.3

    Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to

    Affected: fixed in 2.0.1.

  • CVE-2024-32000Medium 4.3

    Truncated content of messages can be leaked from matrix-appservice-irc

    Affected: fixed in 2.0.0.

  • matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms

    Affected: fixed in 1.0.1.

  • CVE-2023-38690Medium 5.8

    matrix-appservice-irc IRC command injection via admin commands containing newlines

    Affected: fixed in 1.0.1.

  • CVE-2022-3971Medium 4.6

    matrix-appservice-irc PgDataStore.ts sql injection

    Affected: fixed in 0.36.0.

  • Parsing issue in matrix-org/node-irc leading to room takeovers

    Affected: fixed in 0.35.0.

  • CVE-2022-39202Medium 4.3

    IRC mode parameter confusion in matrix-appservice-irc

    Affected: fixed in 0.35.0.

  • Improper handling of multiline messages in matrix-appservice-irc

    Affected: fixed in 0.33.2.