PatchTheCVECVE-2025-27146: matrix-appservice-irc is a Node.js IRC bridge for Matrix
CVE-2025-27146 is a low-severity flaw (CVSS 2.7) affecting matrix irc bridge. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-27146?
matrix irc bridge: upgrade to 3.0.4. Exact commands for each OS are on this page.
Is CVE-2025-27146 being exploited?
CVE-2025-27146 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-27146 affect?
CVE-2025-27146 affects matrix irc bridge. Severity is low (CVSS 2.7). matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject com
How urgent is CVE-2025-27146?
Priority 18/100. No elevated risk signals yet.