CVE-2022-29166

Name of the Vulnerable Software and Affected Versions matrix-appservice-irc versions prior to 0.33.2

Description The issue allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. This is due to a vulnerability in the node-irc component of the matrix-appservice-irc software. Users should refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms to minimize the risk.

Recommendations For versions prior to 0.33.2, update to version 0.33.2 to resolve the issue. As a temporary workaround, consider refraining from replying to messages from untrusted participants in IRC-bridged Matrix rooms until the update is applied.