UnrealIRCd: Command injection in labeled-response module (CVE-2026-114713)

CVE-2026-114713 is a command injection vulnerability affecting the labeled-response module in UnrealIRCd versions 6.0.0 through 6.2.7.0. The vulnerability occurs because the application fails to properly escape IRCv3 "label" tags when echoing them into server replies. On networks with two or more linked servers, an attacker can leverage this flaw to inject arbitrary server-to-server commands that execute with the authority of the server. This vulnerability carries a CVSS score of 8.6.

Impact

Successful exploitation allows for the execution of unauthorized server-to-server commands, potentially leading to full network compromise, unauthorized modifications to IRC services, or service disruption, as commands are processed with server-level privileges.

Recommendation

• Upgrade all UnrealIRCd instances to version 6.2.7.1 or later immediately to address the insecure handling of IRCv3 tags.
• Audit server-to-server (S2S) traffic logs for unusual command patterns or syntax deviations in label-related messages.
• For environments unable to patch immediately, isolate linked IRC servers to restrict the potential blast radius of server-to-server command injection.