CVE-2026-45288
Deferred Deferred - Pending Action
Marten PostgreSQL Full-Text Search SQL Injection

Publication date: 2026-05-28

Last updated on: 2026-06-01

Assigner: GitHub, Inc.

Description
Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-06-01
Generated
2026-06-19
AI Q&A
2026-05-29
EPSS Evaluated
2026-06-18
NVD
CVE-2026-45288
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
martendb marten 8.36.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in Marten, a .NET Transactional Document DB and Event Store on PostgreSQL, in versions prior to 8.36.1. The issue is that Marten's full-text search APIs directly interpolate the user-supplied regConfig parameter into the generated SQL queries without proper parameterization or validation. This means that if untrusted input is passed to regConfig, it can lead to SQL injection, allowing an attacker to manipulate the database queries.

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to perform SQL injection attacks. Such attacks can lead to unauthorized access, data leakage, data modification, or even complete compromise of the database. The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Marten to version 8.36.1 or later, where the issue has been fixed.

Compliance Impact

The vulnerability in Marten prior to version 8.36.1 allows SQL injection through the regConfig parameter, which can lead to unauthorized access, modification, or deletion of data.

Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized data access.

Therefore, systems using vulnerable versions of Marten may be at risk of non-compliance due to the high severity of this vulnerability (CVSS 9.8) affecting confidentiality, integrity, and availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45288. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart