MARTEN · CVE-2026-75513 · Package
FIX → 9.13.0 · 8.37.4
Marten's LINQ provider pasted some runtime values, such as a dictionary indexer key used in a Where filter, into generated SQL inside single-quoted literals without escaping. A value containing a single quote can break out of the literal and run arbitrary SQL, which allows reading or changing other tenants' rows.
first public Jul 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Marten's LINQ provider with values an attacker can influence, such as a dictionary indexer key or ContainsKey argument taken from user input, a constant projected in Select, or a tenant id passed to projection teardown or partition provisioning. Applications that only use fixed keys and ids in code are not reachable this way. The sources say the Newtonsoft serializer path is exposed while System.Text.Json escapes the quote for ContainsKey.
Not affected if no-user-controlled-keys, static-query-values, versions-patched
Who cares dotnet, marten, multi-tenant, nuget, postgresql
Marten NuGet package in your project files (*.csproj, packages.lock.json) and note its version.Where filters that index a Dictionary with a value taken from user input, and for calls on such input.Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote (') could break out of the literal and inject arbitrary SQL.
The primary vector is a Dictionary<,> indexer key used in a Where filter — Where(x => x.Attributes[key] == v) — a common "filter by attribute name" / EAV pattern. It is confirmed with an executed proof-of-concept and yields filter / multi-tenant authorization bypass (returning other tenants' rows) and blind data exfiltration. Where the application permits ;-batched statements (Npgsql default), data modification is also possible.
Linq/Members/Dictionaries/DictionaryItemMember.cs — dictionary indexer key (primary, confirmed PoC)Linq/Members/Dictionaries/DictionaryContainsKeyFilter.cs — Dictionary.ContainsKey(key) (Newtonsoft serializer only; System.Text.Json escapes the quote)Linq/Parsing/SelectParser.cs — a constant string projected through Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
ContainsKeyUpgrade to 9.13.0 · 8.37.4
Marten 8.37.4 for the 8.x line (affected from 7.0.0 up to but not including 8.37.4)Marten 9.13.0 for the 9.x line (affected from 9.0.0 up to but not including 9.13.0)Select(x => new { L = runtimeString })Internal/Operations/DeleteAllForTenant.cs — tenant id reaching per-tenant projection teardown via IEventStore.DeleteProjectionProgressAsync (an in-code comment wrongly claimed the value was validated)Schema/DatabaseScopedTenantPartitions.cs — tenant id inlined into FOR VALUES IN ('...') partition DDLEvents/Daemon/Internals/EventLoader.cs (defense-in-depth) — per-tenant partition-pruning literalBenign: x.Attributes["nonexistent-key"] == "v" returns 0 rows. Attack: x.Attributes["nonexistent' = '' or 1=1 --"] == "v" returns all rows. Generated SQL:
select d.data from public.mt_doc_doc as d where d.data -> 'Attributes' ->> 'x' or 1=1 --' = :p0;
Each sink now escapes embedded single quotes (.Replace("'", "''"), mirroring the existing Ordering.BuildNgramRankExpression) or binds the value as a parameter (DeleteAllForTenant). Where a literal is retained for partition pruning, escaping preserves plan-time pruning while closing the injection. Regression tests lock down each vector.
Until upgrading: do not pass untrusted input as a dictionary indexer key / ContainsKey argument / Select constant, nor as a tenant id into projection teardown or provisioning; and disable multi-statement command batching to limit blast radius.
Reported privately and responsibly by an external security researcher with an executed PoC. Additional sinks found during the follow-up LINQ-wide audit.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.