CVE-2026-75513 Details
Description
Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.
A SQL injection vulnerability has been identified in Marten, a .NET transactional document database and event store that uses PostgreSQL. This issue affects Marten versions 7.0.0 through 9.12.0. The vulnerability arises because several code paths in the LINQ provider and tenant management internals interpolate runtime, potentially attacker-controlled strings into SQL as unescaped single-quoted literals. This flaw allows a crafted string to break out of the literal and inject arbitrary SQL, leading to unauthorized data access or modification. The vulnerability is particularly concerning in multi-tenant applications, where it can bypass tenant isolation and access data from other tenants.
Users should upgrade to Marten version 9.13.0 or later. For those using Marten 8.x, the patched version is 8.37.4.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed | [email protected] | Source CodeVendor |
| https://github.com/JasperFx/marten/pull/4911 | [email protected] | Issue TrackingVendor |
| https://github.com/JasperFx/marten/releases/tag/9.13.0 | [email protected] | Release NotesVendor |
| https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JasperFx Marten | >= 7.0.0, <= 9.12.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |