Executive brief
Marten, a popular document database and event store library for .NET, contains a security flaw in its full-text search functionality. If an application allows users to specify the search language or configuration (the 'regConfig' parameter), an attacker can inject malicious database commands. This could allow an unauthorized person to view sensitive data, modify or delete database tables, or disrupt service availability.
Technical details
A SQL injection vulnerability exists in Marten's full-text search APIs, including SearchAsync, PlainTextSearchAsync, and related LINQ extension methods. The root cause is the direct string interpolation of the user-supplied 'regConfig' parameter into the SQL WHERE clause within the FullTextWhereFragment class. An attacker can provide a crafted string containing single quotes to break out of the SQL literal and execute arbitrary PostgreSQL commands. This is exploitable if the calling application passes untrusted input directly into the regConfig argument. The vulnerability is fixed in version 8.37.0 (and backported to 8.36.1) by implementing regex-based validation to ensure the parameter only contains valid PostgreSQL identifiers.
Affected products
- JasperFx Marten <= 8.36
Timeline
- 2026-05-08: patched: Fix merged in PR #4343
- 2026-05-09: disclosed: Advisory published by vendor
- 2026-05-14: advisory: GitHub Advisory published