PT-2025-7913 · Unknown · Matrix-Appservice-Irc

Funderscore1 · Published 2025-02-25 · Updated 2025-03-04 · CVE-2025-27146

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions matrix-appservice-irc versions prior to 3.0.4

Description The issue affects the matrix-appservice-irc bridge, allowing for arbitrary IRC command execution as the puppeted user. However, the attacker can only inject commands executed as their own IRC user.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 to resolve the issue.

Exploit

Fix

Argument Injection

Command Injection

Weakness Enumeration

CWE-88

CWE-77

Related Identifiers

CVE-2025-27146

GHSA-5MVM-89C9-9GM5

Affected Products

Matrix-Appservice-Irc

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27146.json · Exploit
• https://github.com/matrix-org/matrix-appservice-irc/commit/74f02c8e11f16ed1b355700092c1aa9c036a11bd · Patch
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-5mvm-89c9-9gm5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27146 · Security Note
• https://osv.dev/vulnerability/GHSA-5mvm-89c9-9gm5 · Vendor Advisory
• https://github.com/matrix-org/matrix-appservice-irc · Note
• https://twitter.com/CVETracker/status/1894840041710497824 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1894576495810527319 · Twitter Post
• https://t.me/cvedetector/18922 · Telegram Post
• https://t.me/cvenotify/113445 · Telegram Post
• https://twitter.com/dailycve/status/1897048572451008853 · Twitter Post
• https://twitter.com/CVEnew/status/1894496057276731703 · Twitter Post