matrix-appservice-irc allows IRC Command injection in provisioning API

published 2024-11-14 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-45920

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits: 0; none known

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in matrix-appservice-irc version 3.0.3.

Patch / fix

fixed in 1 links 1

matrix matrix_irc_bridge 3.0.3

github.com/matrix-org/matrix-appservice-irc@4a024ea commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 23 mo ago (2024-11-14)

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

matrix-org matrix-appservice-irc

Classification

Weakness

CWE-147 Improper Neutralization of Input Terminators

References

Sources

CVE List CVE-2024-52505
NVD CVE-2024-52505

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary