CVE-2026-45288
Marten PostgreSQL Full-Text Search SQL Injection
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| martendb | marten | 8.36.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Marten prior to version 8.36.1 allows SQL injection through the regConfig parameter, which can lead to unauthorized access, modification, or deletion of data.
Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized data access.
Therefore, systems using vulnerable versions of Marten may be at risk of non-compliance due to the high severity of this vulnerability (CVSS 9.8) affecting confidentiality, integrity, and availability.
Can you explain this vulnerability to me?
The vulnerability exists in Marten, a .NET Transactional Document DB and Event Store on PostgreSQL, in versions prior to 8.36.1. The issue is that Marten's full-text search APIs directly interpolate the user-supplied regConfig parameter into the generated SQL queries without proper parameterization or validation. This means that if untrusted input is passed to regConfig, it can lead to SQL injection, allowing an attacker to manipulate the database queries.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an attacker to perform SQL injection attacks. Such attacks can lead to unauthorized access, data leakage, data modification, or even complete compromise of the database. The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Marten to version 8.36.1 or later, where the issue has been fixed.