Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.

Affected: NuGet: Marten

## Summary

Marten's full-text search APIs interpolated the user-supplied `regConfig` parameter directly into the generated SQL without parameterization or validation, making every code path that exposes `regConfig` to untrusted input a SQL injection sink.

## Affected APIs

- `IQuerySession.SearchAsync<T>(string searchTerm, string regConfig, ...)` - `IQuerySession.PlainTextSearchAsync<T>(...)` - `IQuerySession.PhraseSearchAsync<T>(...)` - `IQuerySession.WebStyleSearchAsync<T>(...)` - `IQuerySession.PrefixSearchAsync<T>(...)` - `IQueryable<T>.Where(x => x.Search(term, regConfig))` and the matching `PlainTextSearch` / `PhraseSearch` / `WebStyleSearch` / `PrefixSearch` extension methods

## Details

In the affected versions, [`FullTextWhereFragment`](https://github.com/JasperFx/marten/blob/master/src/Marten/Linq/SqlGeneration/Filters/FullTextWhereFragment.cs) renders the WHERE-clause SQL by string interpolation:

```csharp private string Sql => $"to_tsvector('{_regConfig}'::regconfig, {_dataConfig}) @@ {_searchFunction}('{_regConfig}'::regconfig, ?)"; ```

`_regConfig` arrives unchanged from the public API surface above. Any value containing a single quote terminates the SQL literal and lets an attacker append arbitrary PostgreSQL.

### Confirmed exploit shapes (with `regConfig` set to attacker-controlled input)

| Goal | Payload | | --- | --- | | Time-based blind | `english'::text); SELECT pg_sleep(5); --` | | Information disclosure | `english'; SELECT version(); --` | |…