CVE
CVE-2026-45288
Marten has an SQL injection vulnerability in its full-text search regConfig parameter
Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.8
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
C
H
U
9.8
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related Resources
No items found.
References
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45288.json, https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c, https://nvd.nist.gov/vuln/detail/CVE-2026-45288, https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f, https://github.com/JasperFx/marten/pull/4343