CVE-2023-38690

    Dashboard / Vulnerabilities / CVE-2023-38690

    CVE-2023-38690

    Published: 4 Aug 2023Last Modified: 12 Aug 2026

    Summary: matrix-appservice-irc IRC command injection via admin commands containing newlines

    Details: matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.

    References: https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38690.json, https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-3pmj-jqqp-2mj3, https://nvd.nist.gov/vuln/detail/CVE-2023-38690, https://github.com/matrix-org/matrix-appservice-irc/commit/0afb064635d37e039067b5b3d6423448b93026d3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c557cbe011a81a930e0c2cba599ebca021a7cab8

    Affected versions

    1.0.0
    1.0.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-38690 | CVE-DB