A malicious (or compromised) relay remote can send a "buffer_closed" event with an array, causing a use-after-free (read and write) followed by a double free, in the relay plugin.
Note: if the remote is a trusted WeeChat, the problem does not happen, as WeeChat itself never sends an array in the "buffer_closed" event.
Mitigation
Always connect to a trusted WeeChat remote.
Credit
The issue was discovered by Mohammed Arib (arib06).
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
When a batch message is received and one of the messages causes a disconnection from the server, the remaining messages are reading data that is already freed.
When writing a log file, a specific char used internally as separator may be used to forge a new path that can be outside the path configured by the option logger.file.path.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
Credit
The issue was discovered by Mohammed Arib (arib06).
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
The messages received on "handshake" endpoint, which does not require authentication, are not freed if the content is not a JSON object (for example an array or any other JSON type).
A malicious client can send large arrays and cause memory exhaustion. The WeeChat process can be killed by the OOM killer.
Mitigation
There are multiple ways to mitigate this issue:
Remove all relays with protocol "api", see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
Secure relay to allow only trusted IP addresses, see: /help relay.network.allowed_ips