What’s Vulnerable › Vulnerabilities

CVE-2023-38700: matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-04 · updated 2026-06-17
• Weakness: CWE-200

Description

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As a workaround, set the `matrixHandler.eventCacheSize` config value to `0`. This workaround may impact performance.

Affected products

• matrix-org matrix-appservice-irc: before 1.0.1 — fixed in 1.0.1

How to fix

Upgrade to a fixed version: matrix-org matrix-appservice-irc 1.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/matrix-org/matrix-appservice-irc/commit/8bbd2b69a16cbcbeffdd9b5c973fd89d61498d75
• https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c7hh-3v6c-fj4q
• https://github.com/matrix-org/matrix-appservice-irc/commit/8bbd2b69a16cbcbeffdd9b5c973fd89d61498d75
• https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c7hh-3v6c-fj4q

Get alerted when CVE-2023-38700 or the next vulnerability affects your stack