{"id":"RUSTSEC-2025-0043","revision":"fa6aecf9d21b4f6a873d3568a433cf3d","records":[{"revision":"fa6aecf9d21b4f6a873d3568a433cf3d","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2025-0043","aliases":["CVE-2025-53549","GHSA-275g-g844-73jh"],"title":"matrix-sdk-sqlite: SQL injection vulnerability in `SqliteEventCacheStore::find_event_with_relations`","description":"The `SqliteEventCacheStore::find_event_with_relations` function constructs SQL\nqueries using `format!()` with unescaped input, allowing an attacker to inject\narbitrary SQL. This results in a SQL injection vulnerability.","state":0,"publishedAt":"2025-07-11T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:10.9505381+00:00","affected":[{"ecosystem":"crates.io","name":"matrix-sdk-sqlite","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.11.0"},{"kind":"fixed","version":"0.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/matrix-sdk-sqlite","https://rustsec.org/advisories/RUSTSEC-2025-0043.html","https://github.com/matrix-org/matrix-rust-sdk/pull/4849"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0043","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2025-0043","identifiers":["RUSTSEC-2025-0043","CVE-2025-53549","GHSA-275g-g844-73jh"]},"retained":false,"historicalAffected":[]}],"coverage":[]}