# CVE-2025-27146: Matrix IRC Bridge command injection in puppeted user

Source: https://junglewise.ai/threats/cve-2025-27146-matrix-irc-bridge-command-injection-in-puppeted-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-02-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-27146 · Severity: low · CVSS 3.1 · Published 2025-02-25

The Matrix IRC Bridge is a service that allows users to communicate between Matrix chat networks and IRC channels. A vulnerability allows authenticated users with elevated privileges to inject malicious IRC commands that execute as their own IRC user account, potentially disrupting IRC channel operations or manipulating messages. The impact is limited because attackers can only compromise their own IRC identity, not other users' accounts.

Technologies: [matrix-appservice-irc (npm)](https://junglewise.ai/threats/technologies/matrix-appservice-irc). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-27146 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-27146 being exploited in the wild.

**How severe is CVE-2025-27146?** Low severity, with a CVSS score of 3.1, published 25 February 2025.

**Which products and versions are affected?** matrix-appservice-irc (npm) SEMVER:introduced=0,fixed=3.0.4.

**Is there a fix for CVE-2025-27146?** Yes. matrix-appservice-irc (npm): upgrade to 3.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-27146 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-27146?** Check whether you run matrix-appservice-irc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-appservice-irc (npm): upgrade to 3.0.4 or later

  ```sh
  npm install matrix-appservice-irc@3.0.4
  ```


## Technical details

The vulnerability is a command injection flaw (CWE-77, CWE-88) in matrix-appservice-irc versions before 3.0.4, located in BridgedClient.ts. The vulnerability occurs when the bridge constructs IRC commands without properly neutralizing special elements such as newline characters in user input. An attacker with high privileges can inject newline characters to break out of the intended command and execute arbitrary IRC commands as their own puppeted user. The attack requires network access and high-privilege authentication but no user interaction. The fix, implemented in version 3.0.4, replaces newline characters with pipe characters ("|") to match IRC conventions and prevent command injection.

## Affected products

- Matrix matrix-appservice-irc < 3.0.4

## Identifiers

- CVE-2025-27146
- GHSA-5mvm-89c9-9gm5

## Timeline

- 2025-02-25: disclosed
- 2025-02-25: patched: Patch released in version 3.0.4

## References

- [https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-5mvm-89c9-9gm5](https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-5mvm-89c9-9gm5)
- [https://github.com/matrix-org/matrix-appservice-irc/commit/74f02c8e11f16ed1b355700092c1aa9c036a11bd](https://github.com/matrix-org/matrix-appservice-irc/commit/74f02c8e11f16ed1b355700092c1aa9c036a11bd)
- [https://github.com/matrix-org/matrix-appservice-irc](https://github.com/matrix-org/matrix-appservice-irc)

## Related threats

- [Matrix AppService IRC message content leak via timestamp spoofing](https://junglewise.ai/threats/cve-2024-39691-matrix-appservice-irc-message-content-leak-via-timestamp-spoofing)
- [Matrix IRC Bridge message content information disclosure](https://junglewise.ai/threats/cve-2024-32000-matrix-irc-bridge-message-content-information-disclosure)
- [Matrix matrix-appservice-irc IRC command injection via newlines](https://junglewise.ai/threats/cve-2023-38690-matrix-matrix-appservice-irc-irc-command-injection-via-newlines)
- [Matrix AppService IRC information disclosure in event handling](https://junglewise.ai/threats/cve-2023-38700-matrix-appservice-irc-information-disclosure-in-event-handling)
- [Matrix-appservice-irc SQL injection via roomIds argument](https://junglewise.ai/threats/cve-2022-3971-matrix-appservice-irc-sql-injection-via-roomids-argument)