9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45288

CVE-2026-45288: Marten has an SQL injection vulnerability in its full-text search regConfig parameter

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45288

CVE-2026-45288:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Marten	nuget	<= 8.36	8.37.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection flaw within Marten's full-text search functionality. The root cause lies in the Marten.Linq.SqlGeneration.Filters.FullTextWhereFragment class, specifically its constructor and the Sql property. The regConfig parameter, which specifies the text-search configuration, was taken from user input and directly concatenated into the generated SQL query without any validation or parameterization. This allows an attacker to break out of the string literal and execute arbitrary SQL commands, leading to potential data exfiltration, modification, or denial of service.

The patch, identified in commit 626249656829860b9c55895b5b6046b61a2a695f, addresses this by adding a strict validation mechanism. A new private method, ValidateRegConfig, was introduced, which uses a regular expression to ensure that the regConfig value is a simple, valid PostgreSQL identifier. This validation is now the first step in the FullTextWhereFragment constructor, effectively closing the injection vector. Any of the public-facing full-text search APIs (like SearchAsync, PlainTextSearchAsync, etc.) that accept a regConfig parameter were entry points to this vulnerability, as they all lead to the instantiation of the vulnerable FullTextWhereFragment class.

Vulnerable functions

Marten.Linq.SqlGeneration.Filters.FullTextWhereFragment.FullTextWhereFragment

src/Marten/Linq/SqlGeneration/Filters/FullTextWhereFragment.cs

The constructor for `FullTextWhereFragment` takes a `regConfig` string which is directly interpolated into the SQL query in the `Sql` property. There was no validation or sanitization on this parameter, allowing an attacker to inject arbitrary SQL by crafting a malicious `regConfig` string. The patch introduced a validation method, `ValidateRegConfig`, which is now called at the beginning of the constructor to prevent this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.