Advisories for Npm/Matrix-Org-Irc package

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in matrix-org-irc.

node-irc is a socket wrapper for the IRC protocol that extends Node.js' EventEmitter. The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of the message be sent to the IRC server verbatim rather than as a message to the channel. The vulnerability has been patched in …