https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 10:12:32 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-45288 <p>Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten&#39;s full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.</p> <p>Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten&#39;s full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. This vulnerability is fixed in 8.36.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-45288 https://db.gcve.eu/vuln/ghsa-vmw2-qwm8-x84c <p><strong>Affected:</strong> NuGet: Marten</p> <p>## Summary</p> <p>Marten&#39;s full-text search APIs interpolated the user-supplied `regConfig` parameter directly into the generated SQL without parameterization or validation, making every code path that exposes `regConfig` to untrusted input a SQL injection sink.</p> <p>## Affected APIs</p> <p>- `IQuerySession.SearchAsync&lt;T&gt;(string searchTerm, string regConfig, ...)` - `IQuerySession.PlainTextSearchAsync&lt;T&gt;(...)` - `IQuerySession.PhraseSearchAsync&lt;T&gt;(...)` - `IQuerySession.WebStyleSearchAsync&lt;T&gt;(...)` - `IQuerySession.PrefixSearchAsync&lt;T&gt;(...)` - `IQueryable&lt;T&gt;.Where(x =&gt; x.Search(term, regConfig))` and the matching `PlainTextSearch` / `PhraseSearch` / `WebStyleSearch` / `PrefixSearch` extension methods</p> <p>## Details</p> <p>In the affected versions, [`FullTextWhereFragment`](https://github.com/JasperFx/marten/blob/master/src/Marten/Linq/SqlGeneration/Filters/FullTextWhereFragment.cs) renders the WHERE-clause SQL by string interpolation:</p> <p>```csharp private string Sql =&gt; $&#34;to_tsvector(&#39;{_regConfig}&#39;::regconfig, {_dataConfig}) @@ {_searchFunction}(&#39;{_regConfig}&#39;::regconfig, ?)&#34;; ```</p> <p>`_regConfig` arrives unchanged from the public API surface above. Any value containing a single quote terminates the SQL literal and lets an attacker append arbitrary PostgreSQL.</p> <p>### Confirmed exploit shapes (with `regConfig` set to attacker-controlled input)</p> <p>| Goal | Payload | | --- | --- | | Time-based blind | `english&#39;::text); SELECT pg_sleep(5); --` | | Information disclosure | `english&#39;; SELECT version(); --` | |…</p> <p><strong>Affected:</strong> NuGet: Marten</p> <p>## Summary</p> <p>Marten&#39;s full-text search APIs interpolated the user-supplied `regConfig` parameter directly into the generated SQL without parameterization or validation, making every code path that exposes `regConfig` to untrusted input a SQL injection sink.</p> <p>## Affected APIs</p> <p>- `IQuerySession.SearchAsync&lt;T&gt;(string searchTerm, string regConfig, ...)` - `IQuerySession.PlainTextSearchAsync&lt;T&gt;(...)` - `IQuerySession.PhraseSearchAsync&lt;T&gt;(...)` - `IQuerySession.WebStyleSearchAsync&lt;T&gt;(...)` - `IQuerySession.PrefixSearchAsync&lt;T&gt;(...)` - `IQueryable&lt;T&gt;.Where(x =&gt; x.Search(term, regConfig))` and the matching `PlainTextSearch` / `PhraseSearch` / `WebStyleSearch` / `PrefixSearch` extension methods</p> <p>## Details</p> <p>In the affected versions, [`FullTextWhereFragment`](https://github.com/JasperFx/marten/blob/master/src/Marten/Linq/SqlGeneration/Filters/FullTextWhereFragment.cs) renders the WHERE-clause SQL by string interpolation:</p> <p>```csharp private string Sql =&gt; $&#34;to_tsvector(&#39;{_regConfig}&#39;::regconfig, {_dataConfig}) @@ {_searchFunction}(&#39;{_regConfig}&#39;::regconfig, ?)&#34;; ```</p> <p>`_regConfig` arrives unchanged from the public API surface above. Any value containing a single quote terminates the SQL literal and lets an attacker append arbitrary PostgreSQL.</p> <p>### Confirmed exploit shapes (with `regConfig` set to attacker-controlled input)</p> <p>| Goal | Payload | | --- | --- | | Time-based blind | `english&#39;::text); SELECT pg_sleep(5); --` | | Information disclosure | `english&#39;; SELECT version(); --` | |…</p> https://db.gcve.eu/vuln/ghsa-vmw2-qwm8-x84c