CVE-2025-53549
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-07-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| matrix | matrix-sdk | 0.11 |
| matrix | matrix-sdk | 0.13 |
| matrix | matrix-sdk | 0.12 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an SQL injection in the EventCache::find_event_with_relations method of the Matrix Rust SDK versions 0.11 and 0.12. It allows malicious room members to execute arbitrary SQL commands in Matrix clients that pass relation types provided by those members directly into this method when using the default sqlite-based store backend. However, exploitation is unlikely because no known clients currently use the API in this way. The issue is fixed in version 0.13.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow malicious room members to execute arbitrary SQL commands within the Matrix client, potentially leading to unauthorized data access, data manipulation, or corruption within the client's local database. However, exploitation is unlikely due to the current usage patterns of the API.
What immediate steps should I take to mitigate this vulnerability?
Upgrade the matrix-sdk library to version 0.13 or later, as this version contains the fix for the SQL injection vulnerability in the EventCache::find_event_with_relations method. Additionally, avoid using the vulnerable API with the default sqlite-based store backend until the upgrade is applied.