Description
The IRC script included in Light 2.7.x before 2.7.30p5, and 2.8.x before 2.8pre10, running EPIC allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | epic4-script-light | 2.7.30p5-1.1 | DSA-156 |
Advisories 1
- DSA-156 epic4-script-light - arbitrary script execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 5555 vdb-entry
- light-channel-execute-script(9943) vdb-entry
- 20020822 Light Security Advisory: Remotely-exploitable code execution mailing-list
- DSA-156 vendor-advisory