{"cve":"CVE-2022-39202","nvd":{"published":"2022-09-13T18:15:15.413","modified":"2026-06-17T04:57:54.377","status":"Modified","description":"matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround users should refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","score":6.3},"cwes":["CWE-269"],"references":["https://github.com/matrix-org/matrix-appservice-irc/commit/5f87dbed87b4b6dc49b7965ff152ee8535719e67","https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-cq7q-5c67-w39w","https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/","https://github.com/matrix-org/matrix-appservice-irc/commit/5f87dbed87b4b6dc49b7965ff152ee8535719e67","https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-cq7q-5c67-w39w"],"products":["matrix:matrix_irc_bridge"],"source":"nvd","synced_at":"2026-10-19T21:35:14.992143698+00:00"},"epss":{"cve":"CVE-2022-39202","score":0.00879,"percentile":0.59089,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-cq7q-5c67-w39w","url":"https://osv.dev/vulnerability/GHSA-cq7q-5c67-w39w","summary":"matrix-appservice-irc vulnerable to IRC mode parameter confusion","modified":"2023-11-08T04:10:14.936420Z","packages":[{"ecosystem":"npm","name":"matrix-appservice-irc","purl":"pkg:npm/matrix-appservice-irc","ranges":["<0.35.0"],"fixed":["0.35.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}