CVE-2025-53549 Matrix Rust SDK allows SQL injection in the EventCache implementation
Malicious room members can execute arbitrary SQL commands in Matrix clients using the Matrix Rust SDK via the EventCache implementation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53549?
CVE-2025-53549 is a medium-severity SQL injection vulnerability in matrix-org matrix-rust-sdk, published on 10 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust. An SQL injection vulnerability in the EventCache::find_event_with_relations method of matrix-sdk 0.11 and 0.12 allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner. This vulnerability is fixed in 0.13.
Weakness: CWE-89
Which versions are affected by CVE-2025-53549?
5 open source packages ship an affected version, including matrix-sdk-sqlite and matrix-sdk.
| Package | Affected | Fixed in |
|---|---|---|
matrix-sdk-sqlite crates.io | From 0.11.0 | 0.13.0 |
matrix-sdk-sqlite crates.io | From 0.11.0 | 0.13.0 |
matrix-sdk-sqlite crates.io | From 0.11.0 | 0.13.0 |
matrix-sdk crates.io | From 0.11.0 | 0.13.0 |
matrix-sdk crates.io | From 0.11.0 | 0.13.0 |
Linux distribution packages (1)
fractal openSUSE:Tumbleweed | All versions | 12.beta+14-1.1 |
How do I fix CVE-2025-53549?
Upgrade matrix-sdk-sqlite to 0.13.0 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-53549 being exploited?
There is no known exploitation of CVE-2025-53549 in the wild and no public exploit code.
Sources
Also known as GHSA-275g-g844-73jh, RUSTSEC-2025-0043, openSUSE-SU-2025:15351-1.