CVE-2025-53549
matrix-sdk-sqlite: SQL injection vulnerability in `SqliteEventCacheStore::find_event_with_relations`
概要
matrix-sdk-sqlite: SQL injection vulnerability in SqliteEventCacheStore::find_event_with_relations
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The SqliteEventCacheStore::find_event_with_relations function constructs SQL
queries using format!() with unescaped input, allowing an attacker to inject
arbitrary SQL. This results in a SQL injection vulnerability.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
crates.io
matrix-sdk-sqlite
[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"0.13.0"}]}]
参照URL
- advisory rustsec.org
- package crates.io
- web github.com