{"id":"CVE-2026-75513","summary":"Marten: SQL injection in Marten's LINQ provider via unescaped string literals","details":"Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.","aliases":["GHSA-rfx3-98h7-v3xp"],"modified":"2026-09-18T03:48:30.481086608Z","published":"2026-09-16T20:46:17.189Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75513.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-89"]},"references":[{"type":"WEB","url":"https://github.com/JasperFx/marten/releases/tag/9.13.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75513.json"},{"type":"ADVISORY","url":"https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75513"},{"type":"FIX","url":"https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed"},{"type":"FIX","url":"https://github.com/JasperFx/marten/pull/4911"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jasperfx/marten","events":[{"introduced":"a038877822c1c1df8ca764ebf2d7f9f7ab64b7a0"},{"fixed":"61882d0424854cb48703f08bdb246894ac576bed"},{"fixed":"a61ef90b210ab7981be7f622406e1c3e39fcc0f0"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"7.0.0"},{"fixed":"9.13.0"}]}}],"versions":["V9.12.0","V9.11.0","V9.10.0","V9.9.1","V9.9.0","V9.8.2","V9.8.1","V9.8.0","V9.7.5","V9.7.4","V9.7.3","V9.7.2","V9.7.1","V9.7.0","V9.6.0","V9.5.3","9.5.2","V9.5.1","V9.5.0","V9.4.0","V9.3.5","V9.3.4","V9.3.3","V9.3.2","V9.3.1","V9.3.0","V9.2.1","V9.2.0","V9.0.2","V9.0.1","V9.0.0","V8.37.0","V8.36.0","V8.35.0","V8.34.2","V8.34.1","V8.34.0","V8.33.0","V8.32.1","V8.32.0","V8.31.0","V8.30.1","V8.30.0","V8.29.3","V8.29.0","V8.28.0","V8.27.0","V8.26.2","V8.26.1","V8.26.0","V8.25","V8.24.0","V8.23.0","V8.22.2","V8.22.1","V8.22.0","V8.21.0","V8.20","V8.19.0","V8.18.3","V8.18.2","V8.18.1","V8.18.0","v8.17.0","V8.16.4","v8.16.3","v8.16.2","V8.16.1","V8.16.0","V8.15.3","V8.15.1","V8.15.0","V8.14.0","V8.13.3","V8.13.2","V8.13.1","V8.13.0","V8.12.0","V8.11.0","V8.10.1","V8.10.0","V8.9.0","V8.8.2","V8.8.1","V8.8.0","V8.7.0","V8.6.0","V8.5.0","V8.4.0","V8.3.2","V8.3.1","V8.3.0","V8.2.1","V8.2.0","V8.1.2","V8.1.0","V8.0.1","V8.0.0","V7.39.1","V7.38.0","V7.37.3","V7.37.2","V7.37.1","V7.37.0","V7.36.0","V7.35.3","V7.35.2","V7.35.1","V7.35.0","V7.34.1","V7.34.0","V7.33.3","v7.33.2","V7.33.1","V7.33.0","V7.32.0","V7.31.3","V7.31.2","V7.31.1","V7.31.0","V7.30.3","V7.30.2","V7.30.1","V7.30.0","V7.29.0","V7.28.2","V7.28.1","V7.28.0","V7.27.0","V7.26.6","V7.26.5","V7.26.4","V7.26.3","V7.26.2","V7.26.1","V7.26.0","V7.25.2","V7.25.1","v7.25.0","V7.24.0","V7.23.1","V7.23.0","V7.22.0","V7.21.1","V7.21.0","V7.20.2","V7.20.1","V7.20.0","V7.19.1","V7.19.0","V7.18.0","V1.17.1","V7.17.0","V7.16.0","V7.15.0","V7.14.0","V7.13.0","V7.12.0","v7.11.0","V7.10.2","V7.10.1","V7.10.0","V7.9.0","V7.8.0","V7.7.0","V7.6.0","V7.5.0","V7.4.0","V7.3.1","V7.3.0","V7.2.0","V7.1.1","V7.1.0","v7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75513.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"}]}