CVE-2022-29166: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue.
References
- github.com/advisories/GHSA-37hr-348p-rmf4
- github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-37hr-348p-rmf4
- github.com/matrix-org/node-irc/security/advisories/GHSA-52rh-5rpj-c3w6
- matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity
- nvd.nist.gov/vuln/detail/CVE-2022-29166
Code Behaviors & Features
Detect and mitigate CVE-2022-29166 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →