Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

matrix-sdk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.2crates.ioPublished

    Matrix Rust SDK vulnerable to SQL Injection through its EventCache implementation

    CVE-2025-53549 · GHSA-275g-g844-73jh

    Affected
    • crates.io matrix-sdk >= 0.11.0, < 0.13.0
    Fixed in
    0.13.0· Vendor fix available
    Issue
    An SQL injection vulnerability in the EventCache::findeventwithrelations method of matrix-sdk 0.11 and 0.12 allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner. Workarounds Passing only trusted (or sanitised) relation types to the filter argument of EventCache::findeventwithrelations() avoids the issue. Patches The issue is fixed in matrix-sdk 0.13. References The issue was introduced in https://github.com/matrix-org/matrix-rust-sdk/pull/4849.

    Recommended action: Upgrade to 0.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Unratedcrates.ioPublished

    matrix-sdk 0.6.0 logs access tokens

    GHSA-fc4h-xcf3-qj5f

    Affected
    • crates.io matrix-sdk >= 0.6.0, < 0.6.2
    Fixed in
    0.6.2· Vendor fix available
    Issue
    When sending Matrix requests using an affected version of matrix-sdk in an application that writes logs using tracing-subscriber (in a way that includes fields of tracing spans such as tracingsubscribers default text output from the fmt module), these logs will contain the user's access token.

    Recommended action: Upgrade to 0.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →