CVE-2025-27146: Matrix IRC Bridge RCE Vulnerability

CVE-2025-27146 Overview

CVE-2025-27146 is a command injection vulnerability in matrix-appservice-irc, a Node.js IRC bridge for the Matrix protocol. Versions up to and including 3.0.3 fail to sanitize newline characters in bridged messages, allowing an authenticated Matrix user to inject arbitrary IRC commands. The injected commands execute as the puppeted IRC user tied to the attacker's Matrix account. The Matrix.org project patched the flaw in version 3.0.4. This weakness maps to CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact

Authenticated Matrix users can inject arbitrary IRC protocol commands executed under their bridged IRC identity, enabling unauthorized channel operations and protocol abuse.

Affected Products

• Matrix matrix-appservice-irc versions up to and including 3.0.3
• Deployments running the Node.js IRC bridge for Matrix homeservers
• Bridged IRC networks connected through vulnerable bridge instances

Discovery Timeline

• 2025-02-25 - CVE-2025-27146 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27146

Vulnerability Analysis

The bridge relays Matrix events to IRC by constructing raw IRC protocol messages from user-supplied text. IRC uses newline characters (\r\n) as command terminators, so any unsanitized newline in bridged content splits the payload into multiple protocol commands. An attacker sending a crafted Matrix message or topic containing embedded newlines causes the bridge to emit additional IRC commands on the socket. Those commands run under the puppeted IRC user attached to the attacker's Matrix identity, limiting the blast radius to actions that user could otherwise perform on the IRC network.

Root Cause

The setTopic function in src/irc/BridgedClient.ts passed the raw topic string directly to this.state.client.send("TOPIC", room.channel, topic) without stripping newline or carriage return characters. Because IRC treats \r\n as a command separator, any embedded newline in the topic value is interpreted by the IRC server as the start of a new command line.

Attack Vector

Exploitation requires an authenticated Matrix account with permission to trigger bridged actions such as setting a channel topic. The attacker embeds \n sequences followed by valid IRC commands inside the topic or message payload. The bridge forwards the concatenated string to the IRC server, which parses each line as an independent command executed with the attacker's bridged IRC session privileges.

// Source: https://github.com/matrix-org/matrix-appservice-irc/commit/74f02c8e11f16ed1b355700092c1aa9c036a11bd
// Security patch in src/irc/BridgedClient.ts
    }

    private async setTopic(room: IrcRoom, topic: string): Promise<void> {
+       // replace newline "\n" with a pipe "|" to follow IRC conventions
+       const sanitized_topic = topic.replace(/\n/g, " | ").replace(/\r/g, "")
+
        if (this.state.status !== BridgedClientStatus.CONNECTED) {
            throw Error("unsafeClient not ready yet");
        }
        // join the room if we haven't already
        await this.joinChannel(room.channel);
-       this.log.info("Setting topic to %s in channel %s", topic, room.channel);
-       return this.state.client.send("TOPIC", room.channel, topic);
+
+       this.log.info("Setting topic to %s in channel %s", sanitized_topic, room.channel);
+       return this.state.client.send("TOPIC", room.channel, sanitized_topic);
    }

The patch replaces \n with a pipe delimiter and strips \r before the value reaches the IRC client send routine, neutralizing the command separator.

Detection Methods for CVE-2025-27146

Indicators of Compromise

• IRC server logs showing multiple commands originating from a bridged user within a single bridge event window
• Bridge log entries where topic or message content contains encoded newline characters or unusual control bytes
• Unexpected IRC operations (JOIN, PART, PRIVMSG, MODE) attributed to puppeted users without matching Matrix-side activity

Detection Strategies

• Parse bridge application logs for Setting topic entries containing raw \n or \r sequences prior to sanitization
• Correlate IRC server command frequency per bridged user against expected Matrix event rates to spot amplification
• Inspect Matrix room state events for topic or body fields containing embedded CR/LF characters targeting bridged channels

Monitoring Recommendations

• Enable verbose logging on matrix-appservice-irc and forward events to a centralized log platform for retention and search
• Alert on any bridged user issuing IRC commands that were not initiated by an equivalent Matrix client action
• Monitor the running bridge version and flag hosts pinned to 3.0.3 or earlier

How to Mitigate CVE-2025-27146

Immediate Actions Required

• Upgrade matrix-appservice-irc to version 3.0.4 or later on every bridge instance
• Audit bridged IRC accounts for unauthorized commands issued during the exposure window
• Restrict which Matrix users are permitted to bridge to sensitive IRC channels until patching completes

Patch Information

The fix is delivered in matrix-appservice-irc3.0.4 via commit 74f02c8e11f16ed1b355700092c1aa9c036a11bd. Full advisory details are published in GitHub Security Advisory GHSA-5mvm-89c9-9gm5. The patch sanitizes topic input by replacing newline characters with pipe delimiters and stripping carriage returns before dispatch to the IRC server.

Workarounds

• Disable Matrix-to-IRC topic bridging until the patched version is deployed
• Apply an input filter at the homeserver or reverse proxy layer that rejects Matrix events containing CR/LF characters in topic or message fields
• Reduce IRC-side privileges of puppeted accounts to limit the scope of any injected commands

# Upgrade matrix-appservice-irc to the patched release
npm install matrix-appservice-irc@3.0.4

# Verify the installed version
npm ls matrix-appservice-irc

# Restart the bridge service after upgrade
systemctl restart matrix-appservice-irc