CVE-2022-39203

matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround operators may disable dynamic channel joining via `dynamicChannels.enabled` to prevent users from joining new channels, which prevents any new channels being bridged outside of what is already bridged, and what is specified in the config.

• CWE-269

• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-xvqg-mv25-rwvwMitigation, Third Party Advisory
• https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/Vendor Advisory
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-xvqg-mv25-rwvwMitigation, Third Party Advisory
• https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/Vendor Advisory

Published

Sep 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39198A deserialization vulnerability existed in dubbo hessian-lit…9.8
• CVE-2022-39199immudb is a database with built-in cryptographic proof and v…5.9
• CVE-2022-3920HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 d…7.5
• CVE-2022-39200Dendrite is a Matrix homeserver written in Go. In affected v…5.3
• CVE-2022-39201Grafana is an open source observability and data visualizati…7.5
• CVE-2022-39202matrix-appservice-irc is an open source Node.js IRC bridge f…6.3
• CVE-2022-39205Onedev is an open source, self-hosted Git Server with CI/CD …9.8
• CVE-2022-39206Onedev is an open source, self-hosted Git Server with CI/CD …9.9
• CVE-2022-39207Onedev is an open source, self-hosted Git Server with CI/CD …5.4
• CVE-2022-39208Onedev is an open source, self-hosted Git Server with CI/CD …7.5
• CVE-2022-39209cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…6.5
• CVE-2022-3921The Listingo WordPress theme before 3.2.7 does not validate …9.8