Matrix Rust SDK allows SQL injection in the EventCache implementation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-53549 · Microsoft / collected KEV context

EUVD-2025-21024

GHSA-275g-g844-73jh

RUSTSEC-2025-0043

cve-program · CVE-2025-53549

• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-275g-g844-73jh
• https://github.com/matrix-org/matrix-rust-sdk/pull/4849

euvd · EUVD-2025-21024

• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-275g-g844-73jh
• https://github.com/matrix-org/matrix-rust-sdk/pull/4849

nvd · CVE-2025-53549

• https://github.com/matrix-org/matrix-rust-sdk/pull/4849
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-275g-g844-73jh

osv · GHSA-275g-g844-73jh

• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-275g-g844-73jh
• https://nvd.nist.gov/vuln/detail/CVE-2025-53549
• https://github.com/matrix-org/matrix-rust-sdk/pull/4849
• https://github.com/matrix-org/matrix-rust-sdk/commit/d0c01006e4808db5eb96ad5c496416f284d8bd3c
• https://github.com/matrix-org/matrix-rust-sdk
• https://rustsec.org/advisories/RUSTSEC-2025-0043.html

osv · RUSTSEC-2025-0043

• https://crates.io/crates/matrix-sdk-sqlite
• https://rustsec.org/advisories/RUSTSEC-2025-0043.html
• https://github.com/matrix-org/matrix-rust-sdk/pull/4849

No related operational record is retained in the current change model.