Vulnerability-Lookup

CVE-2026-45288 (GCVE-0-2026-45288)

Vulnerability from cvelistv5 – Published: 2026-05-28 20:20 – Updated: 2026-05-30 02:13

Title

Marten has an SQL injection vulnerability in its full-text search regConfig parameter

Summary

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/JasperFx/marten/security/advis…	x_refsource_CONFIRM
https://github.com/JasperFx/marten/pull/4343	x_refsource_MISC
https://github.com/JasperFx/marten/commit/6262496…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JasperFx	marten	Affected: < 8.36.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45288",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-30T02:13:42.482682Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-30T02:13:53.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "marten",
          "vendor": "JasperFx",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.36.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten\u0027s full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T20:20:11.377Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c"
        },
        {
          "name": "https://github.com/JasperFx/marten/pull/4343",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JasperFx/marten/pull/4343"
        },
        {
          "name": "https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f"
        }
      ],
      "source": {
        "advisory": "GHSA-vmw2-qwm8-x84c",
        "discovery": "UNKNOWN"
      },
      "title": "Marten has an SQL injection vulnerability in its full-text search regConfig parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45288",
    "datePublished": "2026-05-28T20:20:11.377Z",
    "dateReserved": "2026-05-11T20:14:43.200Z",
    "dateUpdated": "2026-05-30T02:13:53.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45288",
      "date": "2026-07-23",
      "epss": "0.00375",
      "percentile": "0.29995"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45288\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-28T21:16:31.220\",\"lastModified\":\"2026-07-21T09:10:00.107\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten\u0027s full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.\"},{\"lang\":\"es\",\"value\":\"Marten es una base de datos de documentos transaccional .NET y almac\u00e9n de eventos sobre PostgreSQL. Antes de la versi\u00f3n 8.36.1, las API de b\u00fasqueda de texto completo de Marten interpolaban el par\u00e1metro regConfig suministrado por el usuario directamente en el SQL generado sin parametrizaci\u00f3n ni validaci\u00f3n, convirtiendo cada ruta de c\u00f3digo que expone regConfig a entrada no confiable en un sumidero de inyecci\u00f3n SQL. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 8.36.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"JasperFx\",\"product\":\"marten\",\"versions\":[{\"version\":\"\u003c 8.36.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-30T02:13:42.482682Z\",\"id\":\"CVE-2026-45288\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JasperFx/marten/pull/4343\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-05-30T08:13:03+00:00",
      "cve": "CVE-2026-45288",
      "id": "CVE-2026-45288",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Marten has an SQL injection vulnerability in its full-text search regConfig parameter",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45288.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Marten has an SQL injection vulnerability in its full-text search regConfig parameter\", \"source\": {\"advisory\": \"GHSA-vmw2-qwm8-x84c\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"JasperFx\", \"product\": \"marten\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 8.36.1\"}]}], \"references\": [{\"url\": \"https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c\", \"name\": \"https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/JasperFx/marten/pull/4343\", \"name\": \"https://github.com/JasperFx/marten/pull/4343\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f\", \"name\": \"https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten\u0027s full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-28T20:20:11.377Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45288\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-30T02:13:42.482682Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-05-30T02:13:47.829Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45288\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-28T20:20:11.377Z\", \"dateReserved\": \"2026-05-11T20:14:43.200Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-28T20:20:11.377Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45288

Vulnerability from fkie_nvd - Published: 2026-05-28 21:16 - Updated: 2026-07-21 09:10

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f
	security-advisories@github.com	https://github.com/JasperFx/marten/pull/4343
	security-advisories@github.com	https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "marten",
          "vendor": "JasperFx",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.36.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten\u0027s full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1."
    },
    {
      "lang": "es",
      "value": "Marten es una base de datos de documentos transaccional .NET y almac\u00e9n de eventos sobre PostgreSQL. Antes de la versi\u00f3n 8.36.1, las API de b\u00fasqueda de texto completo de Marten interpolaban el par\u00e1metro regConfig suministrado por el usuario directamente en el SQL generado sin parametrizaci\u00f3n ni validaci\u00f3n, convirtiendo cada ruta de c\u00f3digo que expone regConfig a entrada no confiable en un sumidero de inyecci\u00f3n SQL. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 8.36.1."
    }
  ],
  "id": "CVE-2026-45288",
  "lastModified": "2026-07-21T09:10:00.107",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45288",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-30T02:13:42.482682Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-28T21:16:31.220",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JasperFx/marten/pull/4343"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VMW2-QWM8-X84C

Vulnerability from github – Published: 2026-05-14 20:46 – Updated: 2026-06-09 10:24

Summary

Marten has an injection vulnerability in its full-text search regConfig parameter

Details

Summary

Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink.

Affected APIs

IQuerySession.SearchAsync<T>(string searchTerm, string regConfig, ...)
IQuerySession.PlainTextSearchAsync<T>(...)
IQuerySession.PhraseSearchAsync<T>(...)
IQuerySession.WebStyleSearchAsync<T>(...)
IQuerySession.PrefixSearchAsync<T>(...)
IQueryable<T>.Where(x => x.Search(term, regConfig)) and the matching PlainTextSearch / PhraseSearch / WebStyleSearch / PrefixSearch extension methods

Details

In the affected versions, FullTextWhereFragment renders the WHERE-clause SQL by string interpolation:

private string Sql =>
    $"to_tsvector('{_regConfig}'::regconfig, {_dataConfig}) @@ {_searchFunction}('{_regConfig}'::regconfig, ?)";

_regConfig arrives unchanged from the public API surface above. Any value containing a single quote terminates the SQL literal and lets an attacker append arbitrary PostgreSQL.

Confirmed exploit shapes (with `regConfig` set to attacker-controlled input)

Goal	Payload
Time-based blind	`english'::text); SELECT pg_sleep(5); --`
Information disclosure	`english'; SELECT version(); --`
DDL execution	`english'; DROP TABLE mt_doc_article; --`

All five overloads listed above produced SQL containing the verbatim payload.

Impact

Confidentiality: an attacker can append arbitrary SELECT statements and exfiltrate database contents through error channels, response timing, or — if the application surfaces query results — directly.
Integrity / Availability: DDL, UPDATE, DELETE, and pg_sleep-style denial-of-service payloads succeed under the same vector. Concrete impact depends on the database role used by the Marten connection string.
Precondition: the calling application must forward attacker-controlled input into the regConfig parameter (e.g. a ?lang= query string mapped to regConfig). Applications that hard-code regConfig to a compile-time constant are not exploitable.

Patches

Fixed in Marten 8.36.1 (and forward) by #4343.

FullTextWhereFragment now validates regConfig against ^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$ (a simple PostgreSQL identifier, optionally schema-qualified, capped at NAMEDATALEN-1 per side) and throws ArgumentException for anything else. The default value ("english"), schema-qualified configs ("pg_catalog.english"), and the standard PostgreSQL text-search configurations all continue to work.

Workarounds

If users cannot upgrade immediately, do one of the following at the application boundary:

Hard-code regConfig to a compile-time constant ("english", "simple", …) and never accept it from request input.
Validate any externally-sourced regConfig value before passing it to Marten — e.g. against the same regex as the patch (^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$) or against an allowlist of PostgreSQL configurations the application actually uses.
Drop the regConfig argument from the call site so Marten falls back to the safe default.

Resources

Patch PR: JasperFx/marten#4343
Patched file: FullTextWhereFragment.cs
Regression tests: full_text_regconfig_sql_injection.cs
CWE-89: https://cwe.mitre.org/data/definitions/89.html

Credit

Reported privately to the JasperFx team with a working proof of concept covering all five affected overloads.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.36"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Marten"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.37.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45288"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:46:26Z",
    "nvd_published_at": "2026-05-28T21:16:31Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nMarten\u0027s full-text search APIs interpolated the user-supplied `regConfig` parameter directly into the generated SQL without parameterization or validation, making every code path that exposes `regConfig` to untrusted input a SQL injection sink.\n\n## Affected APIs\n\n- `IQuerySession.SearchAsync\u003cT\u003e(string searchTerm, string regConfig, ...)`\n- `IQuerySession.PlainTextSearchAsync\u003cT\u003e(...)`\n- `IQuerySession.PhraseSearchAsync\u003cT\u003e(...)`\n- `IQuerySession.WebStyleSearchAsync\u003cT\u003e(...)`\n- `IQuerySession.PrefixSearchAsync\u003cT\u003e(...)`\n- `IQueryable\u003cT\u003e.Where(x =\u003e x.Search(term, regConfig))` and the matching `PlainTextSearch` / `PhraseSearch` / `WebStyleSearch` / `PrefixSearch` extension methods\n\n## Details\n\nIn the affected versions, [`FullTextWhereFragment`](https://github.com/JasperFx/marten/blob/master/src/Marten/Linq/SqlGeneration/Filters/FullTextWhereFragment.cs) renders the WHERE-clause SQL by string interpolation:\n\n```csharp\nprivate string Sql =\u003e\n    $\"to_tsvector(\u0027{_regConfig}\u0027::regconfig, {_dataConfig}) @@ {_searchFunction}(\u0027{_regConfig}\u0027::regconfig, ?)\";\n```\n\n`_regConfig` arrives unchanged from the public API surface above. Any value containing a single quote terminates the SQL literal and lets an attacker append arbitrary PostgreSQL.\n\n### Confirmed exploit shapes (with `regConfig` set to attacker-controlled input)\n\n| Goal | Payload |\n| --- | --- |\n| Time-based blind | `english\u0027::text); SELECT pg_sleep(5); --` |\n| Information disclosure | `english\u0027; SELECT version(); --` |\n| DDL execution | `english\u0027; DROP TABLE mt_doc_article; --` |\n\nAll five overloads listed above produced SQL containing the verbatim payload.\n\n## Impact\n\n- **Confidentiality**: an attacker can append arbitrary `SELECT` statements and exfiltrate database contents through error channels, response timing, or \u2014 if the application surfaces query results \u2014 directly.\n- **Integrity / Availability**: DDL, `UPDATE`, `DELETE`, and `pg_sleep`-style denial-of-service payloads succeed under the same vector. Concrete impact depends on the database role used by the Marten connection string.\n- **Precondition**: the calling application must forward attacker-controlled input into the `regConfig` parameter (e.g. a `?lang=` query string mapped to `regConfig`). Applications that hard-code `regConfig` to a compile-time constant are not exploitable.\n\n## Patches\n\nFixed in **Marten 8.36.1** (and forward) by [#4343](https://github.com/JasperFx/marten/pull/4343).\n\n`FullTextWhereFragment` now validates `regConfig` against `^[a-zA-Z_][a-zA-Z0-9_]*(\\.[a-zA-Z_][a-zA-Z0-9_]*)?$` (a simple PostgreSQL identifier, optionally schema-qualified, capped at `NAMEDATALEN-1` per side) and throws `ArgumentException` for anything else. The default value (`\"english\"`), schema-qualified configs (`\"pg_catalog.english\"`), and the standard PostgreSQL text-search configurations all continue to work.\n\n## Workarounds\n\nIf users cannot upgrade immediately, do **one** of the following at the application boundary:\n\n1. Hard-code `regConfig` to a compile-time constant (`\"english\"`, `\"simple\"`, \u2026) and never accept it from request input.\n2. Validate any externally-sourced `regConfig` value before passing it to Marten \u2014 e.g. against the same regex as the patch (`^[a-zA-Z_][a-zA-Z0-9_]*(\\.[a-zA-Z_][a-zA-Z0-9_]*)?$`) or against an allowlist of PostgreSQL configurations the application actually uses.\n3. Drop the `regConfig` argument from the call site so Marten falls back to the safe default.\n\n## Resources\n\n- Patch PR: [JasperFx/marten#4343](https://github.com/JasperFx/marten/pull/4343)\n- Patched file: [`FullTextWhereFragment.cs`](https://github.com/JasperFx/marten/blob/master/src/Marten/Linq/SqlGeneration/Filters/FullTextWhereFragment.cs)\n- Regression tests: [`full_text_regconfig_sql_injection.cs`](https://github.com/JasperFx/marten/blob/master/src/LinqTests/Bugs/full_text_regconfig_sql_injection.cs)\n- CWE-89: \u003chttps://cwe.mitre.org/data/definitions/89.html\u003e\n\n## Credit\n\nReported privately to the JasperFx team with a working proof of concept covering all five affected overloads.",
  "id": "GHSA-vmw2-qwm8-x84c",
  "modified": "2026-06-09T10:24:28Z",
  "published": "2026-05-14T20:46:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45288"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JasperFx/marten/pull/4343"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/JasperFx/marten"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Marten has an injection vulnerability in its full-text search regConfig parameter"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-45288 (GCVE-0-2026-45288)

FKIE_CVE-2026-45288

GHSA-VMW2-QWM8-X84C

Summary

Affected APIs

Details

Confirmed exploit shapes (with regConfig set to attacker-controlled input)

Impact

Patches

Workarounds

Resources

Credit

Tags

Sightings

Nomenclature

Confirmed exploit shapes (with `regConfig` set to attacker-controlled input)