JasperFx Marten, a .NET transactional document database and event store on PostgreSQL, contained a SQL injection vulnerability (CWE-89) in its full-text search APIs prior to version 8.36.1. The vulnerability is due to direct interpolation of the user-supplied regConfig parameter into generated SQL statements without parameterization or validation. This flaw makes any code path exposing regConfig to untrusted input vulnerable to SQL injection attacks. The issue is resolved in Marten version 8.36.1.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the underlying PostgreSQL database, potentially leading to full compromise of data confidentiality, integrity, and availability. Given the CVSS score of 9.8, the impact is critical, affecting all three security properties (confidentiality, integrity, availability). No known exploits have been reported in the wild so far.

Upgrade to JasperFx Marten version 8.36.1 or later, where this SQL injection vulnerability is fixed. Since this is a software vulnerability in a self-hosted product, users must apply the update themselves. Patch status is confirmed by the vendor advisory stating the issue is fixed in 8.36.1. No alternative mitigations are indicated.