CVE-2026-45288

Name of the Vulnerable Software and Affected Versions Marten versions prior to 8.36.1

Description Marten's full-text search APIs interpolate the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation. This creates a SQL injection sink in any code path where regConfig is exposed to untrusted input, allowing an attacker to terminate the SQL literal and append arbitrary PostgreSQL commands. This can lead to unauthorized information disclosure, data modification, or denial-of-service via time-based blind attacks.

The issue affects the following API endpoints and methods:

The vulnerability is triggered within the FullTextWhereFragment function when rendering the WHERE-clause SQL.

Recommendations Update Marten to version 8.36.1 or later. As a temporary workaround, hard-code regConfig to a compile-time constant and avoid accepting it from request input. As a temporary workaround, validate any externally-sourced regConfig value against the regex ^[a-zA-Z ][a-zA-Z0-9 ]*(.[a-zA-Z ][a-zA-Z0-9 ]*)?$ or an allowlist of approved PostgreSQL configurations before passing it to Marten. As a temporary workaround, remove the regConfig argument from the call site to allow Marten to use the safe default value.