RUSTSEC-2025-0043

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2025-0043

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0043.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2025-0043

Aliases

CVE-2025-53549
GHSA-275g-g844-73jh

Published

2025-07-11T12:00:00Z

Modified

2025-07-11T15:41:59.727517Z

Summary

matrix-sdk-sqlite: SQL injection vulnerability in `SqliteEventCacheStore::find_event_with_relations`

Details

The SqliteEventCacheStore::find_event_with_relations function constructs SQL queries using format!() with unescaped input, allowing an attacker to inject arbitrary SQL. This results in a SQL injection vulnerability.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / matrix-sdk-sqlite

Package

Name: matrix-sdk-sqlite; View open source insights on deps.dev
Purl: pkg:cargo/matrix-sdk-sqlite

Affected ranges

Type: SEMVER
Events: Introduced

0.11.0

Fixed

0.13.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "functions": [
            "matrix_sdk_sqlite::SqliteEventCacheStore::find_event_relations"
        ],
        "os": [],
        "arch": []
    }
}

Database specific

{
    "informational": null,
    "categories": [
        "format-injection"
    ],
    "cvss": null
}