{"id":"CVE-2026-114713","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-114713","summary":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two…","details":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.","published":"2026-11-08T03:16:33.410","modified":"2026-11-14T05:18:24.417","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://forums.unrealircd.org/viewtopic.php?t=9487"},{"type":"WEB","url":"https://www.unrealircd.org/"},{"type":"WEB","url":"https://www.unrealircd.org/index/news"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/11/08/1"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114713"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-14T05:18:24.417"}}