CVE-2026-45288
Marten is a .NET transactional document database and event store that runs on PostgreSQL. Versions before 8.36.1 allow attackers to inject arbitrary SQL through the regConfig parameter in its full‑text search APIs. The issue was fixed in Marten 8.36.1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Marten 8.36.0 and earlier, used in .NET applications that rely on PostgreSQL for storage.
Real-world impact
An attacker who can supply a value for regConfig can execute any SQL command against the database, potentially reading, modifying, or deleting data and compromising the entire application.
Why this severity
The CVSS score of 9.8 reflects a network‑accessible vulnerability that requires no attacker privileges or user interaction, and it can fully compromise confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Marten to version 8.36.1 or later.
- 02Restart the application to ensure the new version is in use.
NVD-referenced vendor advisory
Timeline
- May 28, 2026 · May 28, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.