CVE-2025-53549: Matrix SDK SQL Injection Vulnerability in EventCache Implementation
Summary
CVE-2025-53549: Matrix Rust SDK vulnerable to SQL Injection through its EventCache implementation. Affects matrix-sdk versions >= 0.11.0, < 0.13.0. Fixed in 0.13.0. How to fix ↓
Also tracked for
- matrix-sdk-sqlite · crates.io
The same CVE-2025-53549 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Matrix SDK is a Rust library designed for building Matrix clients, enabling real-time communication and collaboration. It provides functionalities for managing events, handling user interactions, and maintaining state within Matrix rooms. The SDK is widely used in applications that require secure and efficient messaging. However, versions 0.11 and 0.12 of the SDK contain a vulnerability that allows for SQL injection attacks through the EventCache component, specifically in the find_event_with_relations method.
Vulnerability Detail
An SQL injection vulnerability exists in the EventCache::find_event_with_relations method of the matrix-sdk versions 0.11 and 0.12. This flaw allows malicious room members to execute arbitrary SQL commands by manipulating relation types passed into the method. The vulnerability was introduced in a pull request and poses a moderate risk, although exploitation is unlikely as no known clients currently utilize the API in a vulnerable manner. The issue primarily affects applications using the default SQLite store backend.
How To Fix
Minimum fixed version
0.13.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the risk of SQL injection, ensure that only trusted or sanitized relation types are passed to the filter argument of EventCache::find_event_with_relations(). For example:
let safe_relation_type = sanitize_input(user_provided_relation_type);
event_cache.find_event_with_relations(safe_relation_type);
Conclusion
The SQL injection vulnerability in the Matrix SDK's EventCache implementation poses a moderate risk to applications using affected versions. By updating to version 0.13 or later and implementing proper input sanitization, developers can protect their applications from potential exploitation.
See every vulnerability recorded for matrix-sdk →
FAQ
CVE-2025-53549 is an identifier for a security vulnerability in the Matrix SDK that allows SQL injection through the EventCache implementation.
The vulnerability affects versions 0.11 and 0.12 of the Matrix SDK.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Update the matrix-sdk package to version 0.13 or later by modifying your Cargo.toml file and running 'cargo update'.
Ensure that only trusted or sanitized relation types are passed to the filter argument of EventCache::find_event_with_relations to avoid SQL injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-sdk.
