Val Lorentz

**Name of the Vulnerable Software and Affected Versions** matrix-appservice-irc versions prior to 1.0.1 **Description** The issue allows an attacker to craft a command with newlines that would not be properly parsed, enabling them to pass a string of commands as a channel name, which would then be executed by the IRC bridge bot. **Recommendations** For versions prior to 1.0.1, upgrade to version 1.0.1 or above to resolve the issue. As a temporary workaround, consider disabling dynamic channels in the config to disable the most common execution method.

**Name of the Vulnerable Software and Affected Versions** matrix-appservice-irc versions prior to 1.0.1 **Description** The issue allows an attacker to craft an event that leaks part of a targeted message event from another bridged room, requiring knowledge of an event ID to target. **Recommendations** For versions prior to 1.0.1, upgrade to version 1.0.1. As a temporary workaround, consider setting the `matrixHandler.eventCacheSize` config value to `0`, although this may impact performance.

**Name of the Vulnerable Software and Affected Versions** matrix-appservice-irc versions prior to 0.35.0 **Description** The issue arises from a bug in the underlying matrix-org/node-irc library, causing matrix-appservice-irc to incorrectly parse multiple modes in a single mode command. This can potentially result in the wrong user being given permissions. Mode commands can only be executed by privileged users, so exploitation requires an operator to be tricked into running the command on behalf of an attacker. **Recommendations** For versions prior to 0.35.0, update to version 0.35.0 to resolve the issue. As a temporary workaround, refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** matrix-appservice-irc versions prior to 0.33.2 **Description** The issue allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. This is due to a vulnerability in the node-irc component of the matrix-appservice-irc software. Users should refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms to minimize the risk. **Recommendations** For versions prior to 0.33.2, update to version 0.33.2 to resolve the issue. As a temporary workaround, consider refraining from replying to messages from untrusted participants in IRC-bridged Matrix rooms until the update is applied.