PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45288 JasperFx CVE debrief

Marten, a .NET transactional document database and event store built on PostgreSQL, contains a critical SQL injection vulnerability in versions prior to 8.36.1. The flaw exists in the full-text search APIs where the user-supplied `regConfig` parameter is interpolated directly into generated SQL without parameterization or validation. This makes any code path exposing `regConfig` to untrusted input a SQL injection sink, potentially allowing attackers to execute arbitrary SQL commands with the privileges of the database connection. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical) due to its network accessibility, low attack complexity, and no required privileges or user interaction, enabling complete confidentiality, integrity, and availability compromise. The issue was disclosed on May 28, 2026, and resolved in version 8.36.1. Organizations using Marten's full-text search functionality should upgrade immediately and audit application code for any exposure of the `regConfig` parameter to external input.

Vendor
JasperFx
Product
marten
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations running Marten versions prior to 8.36.1 in production environments, particularly those exposing full-text search functionality to end users or external systems. Development teams using Marten should prioritize this upgrade in their dependency management workflows.

Technical summary

The vulnerability stems from improper neutralization of special elements used in an SQL command (CWE-89). Marten's full-text search functionality accepts a `regConfig` parameter that specifies the PostgreSQL text search configuration to use. Rather than treating this as a bound parameter, the library interpolates the value directly into the SQL string. An attacker who can influence the `regConfig` value can inject arbitrary SQL, potentially reading sensitive data, modifying database contents, or executing administrative commands. The attack vector is network-based with no authentication required, making this particularly dangerous for internet-facing applications.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Marten to version 8.36.1 or later immediately
  • Audit application code to identify all locations where regConfig parameter is exposed to untrusted input
  • Review database query logs for suspicious full-text search API usage patterns
  • Implement input validation and allowlisting for any regConfig values that must remain configurable
  • Consider using prepared statements or ORM parameterization for all database interactions
  • Monitor for unauthorized database access or data exfiltration attempts

Evidence notes

Vulnerability confirmed through GitHub Security Advisory GHSA-vmw2-qwm8-x84c and associated commit 626249656829860b9c55895b5b6046b61a2a695f. The fix in pull request 4343 addresses the SQL injection by properly handling the regConfig parameter. CWE-89 (SQL Injection) classification provided by [email protected].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45288 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45288

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45288 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45288

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.