# matrix-appservice-irc (npm) vulnerabilities

9 known vulnerabilities (2 high, 5 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/matrix-appservice-irc

## Advisories (9)

### [CVE-2025-27146](https://cve.now/CVE-2025-27146): Matrix IRC Bridge allows IRC command injection to own puppeted user

- Severity: Low 2.7
- Published: Feb 25, 2025
- Affected: fixed in 3.0.4.

### [CVE-2024-39691](https://cve.now/CVE-2024-39691): Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to

- Severity: Medium 4.3
- Published: Jul 5, 2024
- Affected: fixed in 2.0.1.

### [CVE-2024-32000](https://cve.now/CVE-2024-32000): Truncated content of messages can be leaked from matrix-appservice-irc

- Severity: Medium 4.3
- Published: Apr 12, 2024
- Affected: fixed in 2.0.0.

### [CVE-2023-38700](https://cve.now/CVE-2023-38700): matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms

- Severity: Low 3.5
- Published: Aug 4, 2023
- Affected: fixed in 1.0.1.

### [CVE-2023-38690](https://cve.now/CVE-2023-38690): matrix-appservice-irc IRC command injection via admin commands containing newlines

- Severity: Medium 5.8
- Published: Aug 4, 2023
- Affected: fixed in 1.0.1.

### [CVE-2022-3971](https://cve.now/CVE-2022-3971): matrix-appservice-irc PgDataStore.ts sql injection

- Severity: Medium 4.6
- Published: Nov 13, 2022
- Affected: fixed in 0.36.0.

### [CVE-2022-39203](https://cve.now/CVE-2022-39203): Parsing issue in matrix-org/node-irc leading to room takeovers

- Severity: High 8.8
- Published: Sep 13, 2022
- Affected: fixed in 0.35.0.

### [CVE-2022-39202](https://cve.now/CVE-2022-39202): IRC mode parameter confusion in matrix-appservice-irc

- Severity: Medium 4.3
- Published: Sep 13, 2022
- Affected: fixed in 0.35.0.

### [CVE-2022-29166](https://cve.now/CVE-2022-29166): Improper handling of multiline messages in matrix-appservice-irc

- Severity: High 8.0
- Published: May 5, 2022
- Affected: fixed in 0.33.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/matrix-appservice-irc
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.