{"id":"CVE-2026-114713","aliases":["ALPINE-CVE-2026-114713","EUVD-2026-119377","GHSA-237f-p9h6-wq4r"],"status":"published","title":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\"...","description":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00302,"percentile":0.23299,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-140"],"published":"2026-11-08T02:31:48Z","modified":"2026-11-09T14:30:06Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"unrealircd","fixed_in":["6.1.10-r1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"unrealircd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.10-r1"}]}]}],"products":[{"vendor":"unrealircd","product":"unrealircd"}],"references":[{"url":"https://www.unrealircd.org/"},{"url":"https://www.unrealircd.org/index/news"},{"url":"https://forums.unrealircd.org/viewtopic.php?t=9487"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/08/1"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114713"},{"url":"https://www.unrealircd.org"},{"url":"https://github.com/advisories/GHSA-237f-p9h6-wq4r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-114713","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-114713","description":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.","status":"published","published":"2026-11-08T02:31:48.387Z","modified":"2026-11-12T19:56:06.212Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-140"],"updated_at":"2026-11-08T12:43:02.922925Z"}],"euvd":[{"id":"EUVD-2026-119377","description":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.","status":"published","published":"2026-11-08T02:31:48Z","modified":"2026-11-12T19:56:06Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-08T06:12:04.155226Z"}],"ghsa":[{"id":"GHSA-237f-p9h6-wq4r","title":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\"...","description":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.","status":"published","published":"2026-11-08T03:30:38Z","modified":"2026-11-08T12:33:41Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-140"],"updated_at":"2026-11-08T12:43:16.748037Z"}],"nvd":[{"id":"CVE-2026-114713","description":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.","status":"published","published":"2026-11-08T03:16:33.41Z","modified":"2026-11-12T20:18:16.54Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-140"],"updated_at":"2026-11-08T14:10:04.866641Z"}],"osv":[{"id":"ALPINE-CVE-2026-114713","description":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.","status":"published","published":"2026-11-08T03:16:33.41Z","modified":"2026-11-09T14:30:06.737192363Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-09T15:01:57.650778Z"}]}}