CVE-2026-75513: Marten: SQL injection in Marten's LINQ provider via unescaped string literals
Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Martento a version that resolves this vulnerability.Fixed in 9.13.0
Event History
Frequently Asked Questions
Which deployments are affected?
Marten versions from 7.0.0 until 9.13.0 are affected. Version 9.13.0 contains the fix.
What attacker access is required?
The severity vector indicates low privileges are required and no user interaction is needed. Exploitation requires a runtime string that an attacker can control to reach an affected Marten LINQ or tenant-management path.
Are all dictionary key operations affected regardless of serializer?
The confirmed dictionary indexer key path used by Where filters is affected. ContainsKey handling is affected only when using the Newtonsoft serializer; System.Text.Json is not affected for that ContainsKey path.
When can this lead to data modification rather than data exposure or authorization bypass?
A crafted quote can enable filter or multi-tenant authorization bypass and blind data exfiltration. Data modification may also be possible where the deployment permits semicolon-batched Npgsql statements.
How can teams identify relevant exposure before upgrading?
Identify Marten installations in the affected version range and review use of dictionary indexer keys in Where filters, tenant-management operations, Select parsing, and projection-progress deletion through IEventStore.DeleteProjectionProgressAsync. Also determine whether Newtonsoft-based ContainsKey queries or semicolon-batched Npgsql statements are in use.