This vulnerability arises from the Marten full‑text search API, which directly interpolates the user‑supplied regConfig parameter into SQL statements without parameterization or validation. Because of this flaw, any code path that allows an untrusted regConfig value becomes a SQL injection sink, enabling an attacker to execute arbitrary database commands and potentially compromise confidentiality, integrity, and availability. The weakness is classified as CWE‑89.

The affected product is JasperFx’s Marten, a .NET Transactional Document DB and Event Store built on PostgreSQL. Versions prior to 8.36.1 are vulnerable; upgrading to 8.36.1 or later removes the flaw.

Based on the description, the likely attack vector is the direct interpolation of a user‑supplied regConfig value into SQL statements via Marten’s full‑text search API, which turns any exposed endpoint handling that parameter into a SQL injection entry point. The CVSS score of 9.8 marks this as a critical vulnerability; the EPSS score is not available, but the high severity indicates a significant risk of exploitation in environments where regConfig can be supplied from untrusted sources. The vulnerability is not listed in the CISA KEV catalog, and attackers would need to supply a malicious regConfig value, which is feasible if the API accepts untrusted input, making the overall risk serious without immediate patching.