CVE-2025-27146
Matrix IRC Bridge allows IRC command injection to own puppeted user
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Matrix IRC Bridge allows IRC command injection to own puppeted user
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
- Record
CVE-2025-27146- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-77, CWE-88
- Updated
- 2026-11-02
EUVDEUVD-2025-5368
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
- Record
EUVD-2025-5368- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5mvm-89c9-9gm5
Matrix IRC Bridge allows IRC command injection to own puppeted user
Impact
The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user.
Patches
The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
For more information
If you have any questions or comments about this advisory, please email us at security at matrix.org.
- Record
GHSA-5mvm-89c9-9gm5- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-77, CWE-88
- Updated
- 2026-11-02
NVD
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
- Record
CVE-2025-27146- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-77, CWE-88
- Updated
- 2026-11-02
OSV
Matrix IRC Bridge allows IRC command injection to own puppeted user
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
- Record
CVE-2025-27146- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-77, CWE-88
- Updated
- 2026-11-02
OSVGHSA-5mvm-89c9-9gm5
Matrix IRC Bridge allows IRC command injection to own puppeted user
Impact
The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user.
Patches
The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
For more information
If you have any questions or comments about this advisory, please email us at security at matrix.org.
- Record
GHSA-5mvm-89c9-9gm5- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-77, CWE-88
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-appservice-ircnpm |
before 3.0.4 | 3.0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-27146 is a low vulnerability (CVSS 2.7) in Matrix Irc Bridge, published February 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in matrix-appservice-irc 3.0.4.
References
github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-5mvm-89c9-9gm5
nvd.nist.gov/vuln/detail/CVE-2025-27146