What’s Vulnerable › Vulnerabilities

CVE-2022-29166: Improper handling of multiline messages in matrix-appservice-irc

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-05 · updated 2026-06-17
• Weakness: CWE-74

Description

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue.

Affected products

• matrix-org matrix-appservice-irc: before 0.33.2 — fixed in 0.33.2

How to fix

Upgrade to a fixed version: matrix-org matrix-appservice-irc 0.33.2. Check the vendor advisory for mitigations.

References

• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-37hr-348p-rmf4
• https://matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-37hr-348p-rmf4
• https://matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity

Get alerted when CVE-2022-29166 or the next vulnerability affects your stack