What is GHSA-237f-p9h6-wq4r?

GHSA-237f-p9h6-wq4r is a security advisory published by GitHub Security Advisories with High severity. The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label"...

Which CVE IDs does GHSA-237f-p9h6-wq4r cover?

GHSA-237f-p9h6-wq4r covers the following CVE IDs: CVE-2026-114713. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-237f-p9h6-wq4r?

GHSA-237f-p9h6-wq4r has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-237f-p9h6-wq4rHighCVSS 8.6

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label"...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-114713 →

📋 Description

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-114713
https://forums.unrealircd.org/viewtopic.php?t=9487
https://www.unrealircd.org
https://www.unrealircd.org/index/news
https://github.com/advisories/GHSA-237f-p9h6-wq4r