CVE-2025-53549: matrix-sdk-sqlite SQL Injection Vulnerability in SqliteEventCacheStore
Summary
CVE-2025-53549: matrix-sdk-sqlite: SQL injection vulnerability in SqliteEventCacheStore::find_event_with_relations. Affects matrix-sdk-sqlite versions >= 0.11.0, < 0.13.0. Fixed in 0.13.0. How to fix ↓
Also tracked for
- matrix-sdk · crates.io
The same CVE-2025-53549 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The matrix-sdk-sqlite package is a Rust library designed for managing SQLite databases in applications that utilize the Matrix protocol. It provides functionalities for caching events and managing their relationships efficiently. However, due to improper handling of user input in SQL queries, it is susceptible to SQL injection attacks, which can compromise the integrity and security of the database.
Vulnerability Detail
The vulnerability arises from the SqliteEventCacheStore::find_event_with_relations function, which constructs SQL queries using the format!() macro with unescaped user input. This flaw allows attackers to inject arbitrary SQL commands, potentially leading to unauthorized data access, data manipulation, or even complete database compromise. The vulnerability is categorized as a format injection issue, emphasizing the critical need for proper input sanitization in SQL query construction.
How To Fix
Latest published version: 0.19.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any user input used in SQL queries is properly sanitized and escaped before being passed to the format!() macro. This can be done using parameterized queries or by employing a library that automatically handles input escaping.
Conclusion
The matrix-sdk-sqlite package has a critical SQL injection vulnerability that can be exploited through unescaped user input in SQL queries. It is essential to update to the patched version 0.13.0 or later to mitigate this risk. Additionally, employing proper input sanitization techniques can help prevent such vulnerabilities in the future.
See every vulnerability recorded for matrix-sdk-sqlite →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by allowing attackers to execute arbitrary SQL code on a database.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your Cargo.lock file for vulnerabilities without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, data corruption, or even complete loss of control over the database.
Yes, always use parameterized queries and avoid constructing SQL commands with untrusted user input. Additionally, regularly update your dependencies to include security patches.
More details can be found in the RustSec advisory at https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0043.json.
