{"id":"CVE-2026-114713","published":"2026-11-08T03:16:33.410","lastModified":"2026-11-08T11:16:32.810","description":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","cwes":["CWE-140"],"vendors":[],"products":[],"references":[{"url":"https://forums.unrealircd.org/viewtopic.php?t=9487","tags":[]},{"url":"https://www.unrealircd.org/","tags":[]},{"url":"https://www.unrealircd.org/index/news","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/08/1","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The labeled-response module in UnrealIRCd 6.0.0–6.2.7 fails to escape the IRCv3 'label' message tag when echoing it in server-to-server replies, enabling unauthenticated command injection via malformed labels. This allows any network user on a multi-server setup to execute arbitrary server-authority commands.","exploitability":"Exploitation requires only network access to an affected UnrealIRCd instance with at least two linked servers; no authentication or user interaction is needed.","blast_radius":"Successful exploitation grants attackers server-level command execution authority across the entire IRC network, potentially enabling full compromise of all connected servers and data exfiltration or disruption.","remediation":"Upgrade to UnrealIRCd 6.2.7.1 or later, which patches the label tag escaping vulnerability in the labeled-response module.","detection":"Defenders should monitor server-to-server protocol logs for unexpected or malformed IRCv3 'label' tags containing unescaped control characters (e.g., colons, spaces, or line breaks) in echo responses; such anomalies may indicate injection attempts targeting server commands.","tags":["command-injection","irc","server-to-server","cwe-140","high-severity"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:56:36.473Z"}}