CVE-2023-38690

criticalpriority · track · 39EPSS 0.009 · 58 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.86% (58th) EPSS

CVSS 9.8 · critical

Is it mine?

3 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · ENISA EU

v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · security-advisories@github.comexploitability 3.9 · impact 1.4

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:Nsecondary · OSV

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-77US

affected products (3)

Products and version ranges known to be affected.

matrix-org matrix-appservice-irc≤ < 1.0.1enisa_euvdEU
matrix matrix irc bridge< 1.0.1nvdUScpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:*:*:*
npm matrix-appservice-irc< 1.0.1osvUSpkg:npm/matrix-appservice-irc

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-3pmj-jqqp-2mj3matrix-appservice-irc IRC command injection via admin commands containing newlines 2023-08-04ghsa · osvUS
### Impact It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. ### Patches Versions 1.0.1 and above are patched. ### Workarounds There are no robust workarounds to the bug. You can disable dynamic channels in the config to disable the most common execution method but others may exist. It is highly recommended to upgrade the bridge. ### Credits Discovered and reported by [Val Lorentz](https://valentin-lorentz.fr/). ### For more information If you have any questions or comments about this advisory email us at [security@matrix.org](mailto:security@matrix.org).

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2023-08-04modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan