SQL Injection Vulnerability in Marten Transactional Document DB on PostgreSQL

CVE-2026-45288

What is CVE-2026-45288?

Marten, a .NET-based Transactional Document DB and Event Store that operates on PostgreSQL, is susceptible to SQL injection due to its handling of user-supplied input in the regConfig parameter. In versions prior to 8.36.1, the full-text search APIs interpolated this parameter directly into SQL queries without proper parameterization or validation, exposing the application to potential exploitation through untrusted input. This critical oversight can allow attackers to execute arbitrary SQL commands, leading to data breaches and system compromise. The issue has been rectified in version 8.36.1.

References