Marten

.NET Transactional Document DB and Event Store on PostgreSQL

View on Nuget

Activity

Latest release: 14h ago
Total releases: 465
Cadence: ~daily
Last 12 months: 137

Details

License: MIT
First release: Dec 08, 2015

Releases

Version	Released
`9.36.0` minor	Sep 14, 2026
`9.35.0` minor	Sep 13, 2026
`9.34.0` minor	Sep 13, 2026
`9.33.0` minor	Sep 09, 2026
`9.32.1` patch	Sep 06, 2026
`9.32.0` minor	Sep 04, 2026
`8.38.1` patch	Sep 02, 2026
`9.31.2` patch	Sep 02, 2026
`9.31.1` patch	Sep 02, 2026
`9.31.0` minor	Sep 02, 2026
`8.38.0` minor	Aug 30, 2026
`9.30.0` minor	Aug 26, 2026
`9.29.0` minor	Aug 21, 2026
`9.28.0` minor	Aug 18, 2026
`9.27.0` minor	Aug 18, 2026
`9.26.0` minor	Aug 17, 2026
`9.25.0` minor	Aug 16, 2026
`9.24.0` minor	Aug 15, 2026
`9.23.0` minor	Aug 11, 2026
`9.22.6` patch	Aug 10, 2026
`9.22.5` patch	Aug 06, 2026
`9.22.4` patch	Aug 04, 2026
`9.22.3` patch	Aug 03, 2026
`9.22.2` patch	Jul 31, 2026
`9.22.1` patch	Jul 31, 2026
`9.22.0` minor	Jul 30, 2026
`9.21.0` minor	Jul 30, 2026
`9.20.2` patch	Jul 28, 2026
`9.20.1` patch	Jul 27, 2026
`9.20.0` minor	Jul 26, 2026
`9.19.0` minor	Jul 24, 2026
`9.18.0` minor	Jul 22, 2026
`9.17.1` patch	Jul 20, 2026
`9.17.0` minor	Jul 20, 2026
`9.16.1` patch	Jul 18, 2026
`9.16.0` minor	Jul 17, 2026
`9.15.4` patch	Jul 15, 2026
`9.15.3` patch	Jul 14, 2026
`9.15.2` patch	Jul 14, 2026
`9.15.1` patch	Jul 13, 2026
`9.15.0` minor	Jul 12, 2026
`9.14.1` patch	Jul 10, 2026
`9.14.0` minor	Jul 08, 2026
`9.13.0` minor	Jul 08, 2026
`8.37.4` patch	Jul 08, 2026
`9.13.0-alpha.4` pre	Jul 08, 2026
`9.13.0-alpha.3` pre	Jul 07, 2026
`9.13.0-alpha.2` pre	Jul 06, 2026
`9.12.0` minor	Jun 29, 2026
`9.11.0` minor	Jun 26, 2026

1–50 of 465

Dependencies (6)

Depends on

9.36.0

Used by

158

Supply-chain exposure

158 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-45288 GHSA-vmw2-qwm8-x84c May 14, 2026

Marten has an injection vulnerability in its full-text search regConfig parameter

9.8 / 10
Critical
Network Low None None Unchanged High High High

Summary

Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink.

Affected APIs

IQuerySession.SearchAsync<T>(string searchTerm, string regConfig, ...)

IQuerySession.PlainTextSearchAsync<T>(...)

IQuerySession.PhraseSearchAsync<T>(...)

IQuerySession.WebStyleSearchAsync<T>(...)

IQuerySession.PrefixSearchAsync<T>(...)

IQueryable<T>.Where(x => x.Search(term, regConfig)) and the matching PlainTextSearch / PhraseSearch / WebStyleSearch / PrefixSearch extension methods

Details

In the affected versions, FullTextWhereFragment renders the WHERE-clause SQL by string interpolation:

private string Sql => $"to_tsvector('{_regConfig}'::regconfig, {_dataConfig}) @@ {_searchFunction}('{_regConfig}'::regconfig, ?)";

_regConfig arrives unchanged from the public API surface above. Any value containing a single quote terminates the SQL literal and lets an attacker append arbitrary PostgreSQL.

Confirmed exploit shapes (with regConfig set to attacker-controlled input)

| Goal | Payload | | --- | --- | | Time-based blind | english'::text); SELECT pg_sleep(5); -- | | Information disclosure | english'; SELECT version(); -- | | DDL execution | english'; DROP TABLE mt_doc_article; -- |

All five overloads listed above produced SQL containing the verbatim payload.

Impact

Confidentiality: an attacker can append arbitrary SELECT statements and exfiltrate database contents through error channels, response timing, or — if the application surfaces query results — directly.

Integrity / Availability: DDL, UPDATE, DELETE, and pg_sleep-style denial-of-service payloads succeed under the same vector. Concrete impact depends on the database role used by the Marten connection string.

Precondition: the calling application must forward attacker-controlled input into the regConfig parameter (e.g. a ?lang= query string mapped to regConfig). Applications that hard-code regConfig to a compile-time constant are not exploitable.

Patches

Fixed in Marten 8.36.1 (and forward) by #4343.

FullTextWhereFragment now validates regConfig against ^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$ (a simple PostgreSQL identifier, optionally schema-qualified, capped at NAMEDATALEN-1 per side) and throws ArgumentException for anything else. The default value ("english"), schema-qualified configs ("pg_catalog.english"), and the standard PostgreSQL text-search configurations all continue to work.

Workarounds

If users cannot upgrade immediately, do one of the following at the application boundary:

Hard-code regConfig to a compile-time constant ("english", "simple", …) and never accept it from request input.

Validate any externally-sourced regConfig value before passing it to Marten — e.g. against the same regex as the patch (^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$) or against an allowlist of PostgreSQL configurations the application actually uses.

Drop the regConfig argument from the call site so Marten falls back to the safe default.

Resources

Patch PR: JasperFx/marten#4343

Patched file: FullTextWhereFragment.cs

Regression tests: full_text_regconfig_sql_injection.cs

CWE-89: https://cwe.mitre.org/data/definitions/89.html

Credit

Reported privately to the JasperFx team with a working proof of concept covering all five affected overloads.

Affected versions

0.5.0.80.5.0.90.5.1.340.5.2.360.5.3.380.6.0.430.6.1.460.6.2.570.6.3.670.6.4.770.6.5.780.6.6.82

+ 329 more Show less

0.7.0.850.7.0.970.7.1.1030.8.0.1320.8.10.3550.8.2.1880.8.3.2380.8.4.2550.8.5.2740.8.6.2840.8.7.2970.8.8.2990.8.9.3220.9.0.3790.9.1.4010.9.10.5550.9.11.5560.9.12.5630.9.2.4230.9.2.4270.9.3.4580.9.4.4640.9.5.4730.9.6.4930.9.6.4980.9.7.5150.9.7.5170.9.8.5230.9.9.5340.9.9.5511.0.01.0.0-alpha-6251.0.0-alpha-6391.0.0-alpha-6441.0.0-alpha-6631.0.0-alpha-6641.0.0-alpha-6661.0.0-alpha-6671.0.0-alpha-6681.0.0-alpha-6691.0.0-alpha-7011.0.0-alpha-7031.0.0-alpha-7061.0.0-alpha-7091.0.0-alpha-7101.0.0-alpha-7191.0.11.0.21.0.31.1.01.1.11.1.21.1.31.2.01.2.11.2.21.2.31.2.41.2.51.3.01.4.01.4.11.5.01.5.11.5.21.5.32.0.02.0.0-alpha-506512.0.0-alpha-511332.0.0-alpha-516142.0.0-rc-509302.0.0-rc-512472.1.02.10.02.10.12.10.22.10.32.2.02.3.02.3.12.3.22.4.02.5.02.6.02.7.02.7.12.8.02.8.12.8.22.9.03.0.03.0.0-alpha-13.0.0-alpha-23.0.13.1.03.10.03.11.03.12.03.12.13.12.23.12.33.12.43.13.03.13.13.13.23.13.33.13.43.13.53.14.03.14.13.14.23.14.33.14.43.2.03.3.03.4.03.5.03.6.03.6.13.6.23.7.03.7.13.8.03.8.13.9.04.0.04.0.0-alpha4.0.14.0.24.0.34.0.44.1.04.2.04.3.04.3.15.0.05.1.05.10.05.10.15.11.05.2.05.3.05.3.15.4.05.5.05.5.15.5.25.6.05.7.05.8.05.9.06.0.36.0.46.0.56.1.06.2.06.3.06.4.06.4.16.4.27.0.07.1.07.1.17.10.07.10.17.11.07.12.07.13.07.13.17.14.07.15.07.16.07.17.07.17.17.18.07.19.07.19.17.2.07.20.07.20.17.20.27.21.07.21.17.22.07.23.07.23.17.24.07.25.07.25.17.25.27.26.07.26.17.26.27.26.37.26.47.26.57.26.67.27.07.28.07.28.17.28.27.29.07.3.07.3.17.30.07.30.17.30.27.30.37.31.07.31.17.31.27.31.37.32.07.33.07.33.17.33.27.33.37.34.07.34.17.35.07.35.17.35.27.35.37.36.07.37.07.37.17.37.27.37.37.38.07.38.17.39.07.39.17.39.27.39.37.39.57.39.67.4.07.40.07.40.17.40.27.40.37.40.47.40.57.5.07.6.07.7.07.8.07.9.08.0.08.0.0-alpha-28.0.0-alpha-38.0.0-alpha-58.0.0-alpha-6-8.0.0-beta-18.0.0-beta-28.0.0-rc-18.0.0-rc-28.0.18.1.08.1.28.10.08.10.18.11.08.12.08.13.08.13.18.13.28.13.38.14.08.15.08.15.18.15.28.15.38.15.48.16.08.16.18.16.28.16.38.16.48.17.08.18.08.18.18.18.28.18.38.19.08.2.08.2.18.20.08.21.08.22.08.22.18.22.28.23.08.24.08.25.08.26.08.26.18.26.28.27.08.28.08.29.08.29.18.29.28.29.38.3.08.3.18.3.28.3.38.30.08.30.18.31.08.32.08.32.18.33.08.34.08.34.18.34.28.35.08.36.08.4.08.5.08.6.08.7.08.8.08.8.18.8.28.9.08.9.0-channels-alpha-18.9.0-channels-alpha-2

Fixed in

8.37.0

References

https://github.com/JasperFx/marten/security/advisories/GHSA-vmw2-qwm8-x84c
https://nvd.nist.gov/vuln/detail/CVE-2026-45288
https://github.com/JasperFx/marten/pull/4343
https://github.com/JasperFx/marten/commit/626249656829860b9c55895b5b6046b61a2a695f
https://github.com/JasperFx/marten

Updated Jun 09, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 9
minor 162
patch 205
pre 88

465 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More