SQL Injection Affecting marten package, versions [,8.37.0)

Affected versions of this package are vulnerable to SQL Injection via the regConfig parameter in full-text search APIs. An attacker can execute arbitrary SQL commands by supplying crafted input to the regConfig parameter, which is interpolated directly into SQL statements without validation or parameterization. This can lead to unauthorized data access, data modification, or denial of service through actions such as exfiltrating database contents, executing DDL statements, or causing time-based delays. This is only exploitable if attacker-controlled input is forwarded to the regConfig parameter; applications that hard-code regConfig to a compile-time constant are not affected.

This vulnerability can be mitigated by hard-coding the regConfig parameter to a compile-time constant, validating externally-sourced regConfig values against a strict regex or allowlist, or omitting the regConfig argument to use the safe default.

• GitHub Advisory
• GitHub Commit
• GitHub PR