CVE-2025-27146

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-77 CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Feb 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-271478.2The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deploym CVE-2025-271488.8Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system tem CVE-2025-271492.7Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization CVE-2025-27153.5A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file CVE-2025-271506.5Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance CVE-2025-271519.8Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer ove CVE-2025-271525.3axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative CVE-2025-271536.5Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper access control vulnerabil CVE-2025-271549.8Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prio CVE-2025-271556.1Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (CVE-2025-271565.4Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize CVE-2025-271575.3Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limi