Marten has an injection vulnerability in its full-text search regConfig parameter

Summary

Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink.

Affected APIs

• IQuerySession.SearchAsync<T>(string searchTerm, string regConfig, ...)
• IQuerySession.PlainTextSearchAsync<T>(...)
• IQuerySession.PhraseSearchAsync<T>(...)
• IQuerySession.WebStyleSearchAsync<T>(...)
• IQuerySession.PrefixSearchAsync<T>(...)
• IQueryable<T>.Where(x => x.Search(term, regConfig)) and the matching PlainTextSearch / PhraseSearch / WebStyleSearch / PrefixSearch extension methods

Details

In the affected versions, FullTextWhereFragment renders the WHERE-clause SQL by string interpolation:

private string Sql =>
    $"to_tsvector('{_regConfig}'::regconfig, {_dataConfig}) @@ {_searchFunction}('{_regConfig}'::regconfig, ?)";

_regConfig arrives unchanged from the public API surface above. Any value containing a single quote terminates the SQL literal and lets an attacker append arbitrary PostgreSQL.

Confirmed exploit shapes (with regConfig set to attacker-controlled input)

Goal	Payload
Time-based blind	english'::text); SELECT pg_sleep(5); --
Information disclosure	english'; SELECT version(); --
DDL execution	english'; DROP TABLE mt_doc_article; --

All five overloads listed above produced SQL containing the verbatim payload.

Impact

• Confidentiality: an attacker can append arbitrary SELECT statements and exfiltrate database contents through error channels, response timing, or — if the application surfaces query results — directly.
• Integrity / Availability: DDL, UPDATE, , and -style denial-of-service payloads succeed under the same vector. Concrete impact depends on the database role used by the Marten connection string.