CVE-2022-39202

CVE-2022-39202 is a medium-severity vulnerability affecting matrix-appservice-irc, an open-source Node.js IRC bridge for Matrix. It stems from incorrect parsing of IRC mode commands containing multiple modes, potentially leading to unauthorized privilege escalation for users if an operator is tricked into executing a malicious command. The attack requires user interaction (UI:R) and has low impact on confidentiality, integrity, and availability (C:L/I:L/A:L). There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.