CVE-2025-53549: Matrix Rust SDK SQL Injection Vulnerability

CVE-2025-53549 Overview

CVE-2025-53549 is a SQL injection vulnerability [CWE-89] in the Matrix Rust SDK, a library collection for building Matrix clients in Rust. The flaw resides in the EventCache::find_event_with_relations method of matrix-sdk versions 0.11 and 0.12. When clients pass attacker-controlled relation types directly into this method while using the default SQLite-based store backend, malicious room members can execute arbitrary SQL commands. The vulnerability is fixed in version 0.13. Real-world exploitation is considered unlikely because no known Matrix clients currently invoke the API in the vulnerable manner.

Critical Impact
Malicious room members can execute arbitrary SQL commands against a victim client's local SQLite event store, potentially tampering with or extracting cached Matrix event data.

Affected Products

matrix-sdk 0.11 (Rust crate)
matrix-sdk 0.12 (Rust crate)
Matrix clients using the default sqlite store backend that pass untrusted relation types to EventCache::find_event_with_relations

Discovery Timeline

2025-07-10 - CVE-2025-53549 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53549

Vulnerability Analysis

The Matrix Rust SDK exposes an EventCache::find_event_with_relations method that queries the local event cache for events related to a given target. In versions 0.11 and 0.12, this method concatenates the relation type parameter into a SQL query executed against the default SQLite backend without proper parameterization or escaping.

In the Matrix protocol, relation types describe how one event relates to another, such as replies, edits, or reactions. These values can originate from other room members over the federation layer. When a client forwards those untrusted relation type strings directly to the vulnerable method, an attacker-controlled string becomes part of a composed SQL statement.

The impact is bounded by what the local SQLite event store contains. An attacker cannot reach server-side infrastructure, but they can read, modify, or destroy locally cached Matrix events belonging to the victim client. The maintainers assess exploitation as unlikely because no known client currently chains untrusted relation types into this method.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The vulnerable code path builds a SQL query string using an untrusted relation type value instead of binding it as a parameterized query argument.

Attack Vector

Exploitation requires a malicious room member to send a crafted event whose relation type field contains SQL metacharacters. If a Matrix client built on matrix-sdk 0.11 or 0.12 passes that relation type into find_event_with_relations without validation, the SQLite backend executes the injected SQL against the local event cache database.

Technical details are documented in the GitHub Security Advisory GHSA-275g-g844-73jh and the fix in GitHub Pull Request #4849.

Detection Methods for CVE-2025-53549

Indicators of Compromise

Unexpected modifications, deletions, or new rows in the client's local SQLite event cache database
Matrix events in rooms containing relation type fields with SQL syntax characters such as single quotes, semicolons, or SQL keywords like UNION, SELECT, or DROP
Client-side errors or crashes originating from the matrix-sdk event cache module when processing specific inbound events

Detection Strategies

Perform a software composition analysis on Rust projects to flag any dependency on matrix-sdk versions 0.11 or 0.12
Review client source code for direct calls to EventCache::find_event_with_relations that pass relation type values sourced from remote events without validation
Inspect Matrix event streams for relation type values that do not match expected spec values such as m.replace, m.annotation, or m.thread

Monitoring Recommendations

Monitor file integrity on the SQLite store files used by Matrix client installations
Log and alert on unusual query errors emitted by the matrix-sdk SQLite store backend
Track dependency manifests (Cargo.lock) in CI to detect reintroduction of vulnerable matrix-sdk versions

How to Mitigate CVE-2025-53549

Immediate Actions Required

Upgrade matrix-sdk to version 0.13 or later in all dependent Rust projects
Audit any custom code that calls EventCache::find_event_with_relations and ensure relation types originate from a trusted allowlist
Rebuild and redistribute affected Matrix client binaries after upgrading the dependency

Patch Information

The vulnerability is fixed in matrix-sdk 0.13. The patch, delivered in GitHub Pull Request #4849, replaces unsafe SQL string composition in the EventCache store with parameterized queries so that relation type values are bound as data rather than interpreted as SQL.

Workarounds

Validate relation type strings against an allowlist of known Matrix spec values before passing them to the vulnerable API
Avoid forwarding attacker-controlled relation types from inbound room events directly into find_event_with_relations
Restrict client participation to trusted rooms until the SDK upgrade is applied

bash

# Configuration example: pin a safe matrix-sdk version in Cargo.toml
[dependencies]
matrix-sdk = "0.13"