mmb/weechat-otr — pull request #39 by tribut (2013-11-20 03:22:41+00:00)
Title: Security Fix: split incoming messages at newline characters

When the encrypted message contains a '\n'-character, weechat-otr does not properly create multiple PRIVMSG commands. Instead, everything but the first line in the message is forwarded to the server verbatim as command, leading to arbitrary irc command execution as the receiver's user.

While not a lot of benign jabber clients seem to send text/plain content inside otr messages, I was able to reproduce the erratic behavior using kopete from kubuntu's 12.04 live-cd.