关键漏洞信息 漏洞概述 标题: SQL injection in the Matrix Rust SDK EventCache implementation 严重性: Moderate CVE ID: CVE-2025-53549 影响范围 受影响版本: >= 0.11, < 0.13 修复版本: 0.13 描述 An SQL injection vulnerability in the method of matrix-sdk 0.11 and 0.12 allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner. 解决方案 临时解决方法: Passing only trusted (or sanitised) relation types to the argument of avoids the issue. 修复措施: The issue is fixed in matrix-sdk 0.13. 参考资料 The issue was introduced in #4849.