CVE-2023-38690

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.

• CWE-20
• CWE-77

• https://github.com/matrix-org/matrix-appservice-irc/commit/0afb064635d37e039067b5b3d6423448b93026d3Patch
• https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1Release Notes
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-3pmj-jqqp-2mj3Third Party Advisory
• https://github.com/matrix-org/matrix-appservice-irc/commit/0afb064635d37e039067b5b3d6423448b93026d3Patch
• https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1Release Notes
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-3pmj-jqqp-2mj3Third Party Advisory

Published

Aug 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38685Discourse is an open source discussion platform. Prior to ve…4.3
• CVE-2023-38686Sydent is an identity server for the Matrix communications p…5.3
• CVE-2023-38687Svelecte is a flexible autocomplete/select component written…5.4
• CVE-2023-38688twitch-tui provides Twitch chat in a terminal. Prior to vers…7.5
• CVE-2023-38689Logistics Pipes is a modification (a.k.a. mod) for the compu…9.8
• CVE-2023-3869The wpDiscuz plugin for WordPress is vulnerable to unauthori…5.3
• CVE-2023-38691matrix-appservice-bridge provides an API for setting up brid…6.5
• CVE-2023-38692CloudExplorer Lite is an open source, lightweight cloud mana…9.8
• CVE-2023-38693Lucee Server (or simply Lucee) is a dynamic, Java based, tag…9.8
• CVE-2023-38694Umbraco is an ASP.NET content management system (CMS). Start…5.4
• CVE-2023-38695cypress-image-snapshot shows visual regressions in Cypress w…6.5
• CVE-2023-38696Rejected reason: This CVE has been rejected because it is un…