CVE-2025-53549
MEDIUM EPSS 16.6%
Published Jul 10, 202511mo ago · Modified Jun 17, 20262w ago
5.2 CVSS 4.0
Published Jul 10, 2025 11mo ago
Last Modified Jun 17, 2026 2w ago
Description
The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust. An SQL injection vulnerability in the EventCache::find_event_with_relations method of matrix-sdk 0.11 and 0.12 allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner. This vulnerability is fixed in 0.13.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
16.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-89 SQL Injection Injection
References 2
- github.com https://github.com/matrix-org/matrix-rust-sdk/pull/4849
- github.com https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-275g-g844-73jh
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.