Rust advisories / matrix-sdk-sqlite
Vulnerability MediumRUSTSEC-2025-0043 · matrix-sdk-sqlite
RUSTSEC-2025-0043: matrix-sdk-sqlite: SQL injection vulnerability in `SqliteEventCacheStore::find_event_with_relations`
Short answerA security vulnerability in the matrix-sdk-sqlite crate: matrix-sdk-sqlite: SQL injection vulnerability in `SqliteEventCacheStore::find_event_with_relations`. GitHub rates it Medium. Fixed in 0.13.0: update to a fixed version.
| Crate | matrix-sdk-sqlite |
|---|---|
| Type | Vulnerability (format-injection) |
| Affected versions | From 0.11.0 before 0.13.0. |
| Fixed in | 0.13.0 |
| Severity | Medium (GitHub rating) |
| Published | 2025-07-11 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2025-53549, GHSA-275g-g844-73jh |
| Affected functions | matrix_sdk_sqlite::SqliteEventCacheStore::find_event_relations |
What to do
- See which version you have:
cargo tree -i matrix-sdk-sqlite(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p matrix-sdk-sqlite. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplematrix-sdk-sqlite = "0.13.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The SqliteEventCacheStore::find_event_with_relations function constructs SQL queries using format!() with unescaped input, allowing an attacker to inject arbitrary SQL. This results in a SQL injection vulnerability.
References
- Package: crates.io/crates/matrix-sdk-sqlite
- Advisory: rustsec.org/advisories/RUSTSEC-2025-0043.html
- Web: github.com/matrix-org/matrix-rust-sdk/pull/4849
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?