Cyber Resilience

CVE-2025-27146

Low

Published: 25 February 2025

Published
25 February 2025
Modified
04 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0075 73.6th percentile
Risk Priority 6 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27146 is a low-severity Command Injection (CWE-77) vulnerability in Matrix Matrix Irc Bridge. Its CVSS base score is 2.7 (Low).

Operationally, ranked in the top 26.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own…

more

IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.

CWE(s)
CWE-77CWE-88

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

matrix
matrix irc bridge
≤ 3.0.4

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References