GHSA-vmw2-qwm8-x84c is a critical-severity (CVSS 9.8) SQL Injection vulnerability in Marten. A fix is available for Marten — see the affected versions and patch details below.
Marten has an injection vulnerability in its full-text search regConfig parameter
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-vmw2-qwm8-x84c.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-vmw2-qwm8-x84c plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 379,145 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
MartenReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink.
Affected APIs
IQuerySession.SearchAsync<T>(string searchTerm, string regConfig, ...)IQuerySession.PlainTextSearchAsync<T>(...)IQuerySession.PhraseSearchAsync<T>(...)IQuerySession.WebStyleSearchAsync<T>(...)IQuerySession.PrefixSearchAsync<T>(...)IQueryable<T>.Where(x => x.Search(term, regConfig))and the matchingPlainTextSearch/PhraseSearch/WebStyleSearch/PrefixSearchextension methods
Details
In the affected versions, FullTextWhereFragment renders the WHERE-clause SQL by string interpolation:
private string Sql =>
$"to_tsvector('{_regConfig}'::regconfig, {_dataConfig}) @@ {_searchFunction}('{_regConfig}'::regconfig, ?)";
_regConfig arrives unchanged from the public API surface above. Any value containing a single quote terminates the SQL literal and lets an attacker append arbitrary PostgreSQL.
Confirmed exploit shapes (with regConfig set to attacker-controlled input)
| Goal | Payload |
|---|---|
| Time-based blind | english'::text); SELECT pg_sleep(5); -- |
| Information disclosure | english'; SELECT version(); -- |
| DDL execution | english'; DROP TABLE mt_doc_article; -- |
All five overloads listed above produced SQL containing the verbatim payload.
Impact
- Confidentiality: an attacker can append arbitrary
SELECTstatements and exfiltrate database contents through error channels, response timing, or — if the application surfaces query results — directly. - Integrity / Availability: DDL,
UPDATE,DELETE, andpg_sleep-style denial-of-service payloads succeed under the same vector. Concrete impact depends on the database role used by the Marten connection string. - Precondition: the calling application must forward attacker-controlled input into the
regConfigparameter (e.g. a?lang=query string mapped toregConfig). Applications that hard-coderegConfigto a compile-time constant are not exploitable.
Patches
Fixed in Marten 8.36.1 (and forward) by #4343.
FullTextWhereFragment now validates regConfig against ^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$ (a simple PostgreSQL identifier, optionally schema-qualified, capped at NAMEDATALEN-1 per side) and throws ArgumentException for anything else. The default value ("english"), schema-qualified configs ("pg_catalog.english"), and the standard PostgreSQL text-search configurations all continue to work.
Workarounds
If users cannot upgrade immediately, do one of the following at the application boundary:
- Hard-code
regConfigto a compile-time constant ("english","simple", …) and never accept it from request input. - Validate any externally-sourced
regConfigvalue before passing it to Marten — e.g. against the same regex as the patch (^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$) or against an allowlist of PostgreSQL configurations the application actually uses. - Drop the
regConfigargument from the call site so Marten falls back to the safe default.
Resources
- Patch PR: JasperFx/marten#4343
- Patched file:
FullTextWhereFragment.cs - Regression tests:
full_text_regconfig_sql_injection.cs - CWE-89: https://cwe.mitre.org/data/definitions/89.html
Credit
Reported privately to the JasperFx team with a working proof of concept covering all five affected overloads.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| .NETNuGet | Marten | all versions | 8.37.0dotnet add package Marten --version 8.37.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Marten, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Marten to 8.37.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vmw2-qwm8-x84c is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-vmw2-qwm8-x84c can be triaged on real exposure rather than presence alone.
Tailored to GHSA-vmw2-qwm8-x84c. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-vmw2-qwm8-x84c in your dependencies?
O3 Security finds GHSA-vmw2-qwm8-x84c across NuGet dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.