CVE-2026-45288

CriticalCVSS 9.8

Published: 28/05/2026(UTC)Updated: 21/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

A SQL injection vulnerability was found in the Marten library for .NET in its full-text search APIs. The user-supplied regConfig parameter was directly interpolated into the generated SQL without parameterization or validation.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary SQL queries on the PostgreSQL database, potentially leading to data leakage, modification, or deletion.

Recommendation

Immediately update the Marten library to version 8.36.1 or later, which contains the fix for this vulnerability.

Original NVD description (English source)

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.