{"id":"CVE-2026-75513","kind":"vulnerability","aliases":["CVE-2026-75513","GHSA-rfx3-98h7-v3xp"],"related":[],"title":"Marten's LINQ provider has SQL injection via unescaped string literals","description":"Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote (`'`) could break out of the literal and inject arbitrary SQL.\n\nThe primary vector is a `Dictionary<,>` indexer **key** used in a `Where` filter — `Where(x => x.Attributes[key] == v)` — a common \"filter by attribute name\" / EAV pattern. It is confirmed with an executed proof-of-concept and yields filter / multi-tenant authorization bypass (returning other tenants' rows) and blind data exfiltration. Where the application permits `;`-batched statements (Npgsql default), data modification is also possible.\n\n## Affected sinks\n\n- `Linq/Members/Dictionaries/DictionaryItemMember.cs` — dictionary indexer key (primary, confirmed PoC)\n- `Linq/Members/Dictionaries/DictionaryContainsKeyFilter.cs` — `Dictionary.ContainsKey(key)` (Newtonsoft serializer only; System.Text.Json escapes the quote)\n- `Linq/Parsing/SelectParser.cs` — a constant string projected through `Select(x => new { L = runtimeString })`\n- `Internal/Operations/DeleteAllForTenant.cs` — tenant id reaching per-tenant projection teardown via `IEventStore.DeleteProjectionProgressAsync` (an in-code comment wrongly claimed the value was validated)\n- `Schema/DatabaseScopedTenantPartitions.cs` — tenant id inlined into `FOR VALUES IN ('...')` partition DDL\n- `Events/Daemon/Internals/EventLoader.cs` (defense-in-depth) — per-tenant partition-pruning literal\n\n## Proof of concept (primary vector)\n\nBenign: `x.Attributes[\"nonexistent-key\"] == \"v\"` returns 0 rows. Attack: `x.Attributes[\"nonexistent' = '' or 1=1 --\"] == \"v\"` returns all rows. Generated SQL:\n\n```\nselect d.data from public.mt_doc_doc as d where d.data -> 'Attributes' ->> 'x' or 1=1 --' = :p0;\n```\n\n## Fix\n\nEach sink now escapes embedded single quotes (`.Replace(\"'\", \"''\")`, mirroring the existing `Ordering.BuildNgramRankExpression`) or binds the value as a parameter (`DeleteAllForTenant`). Where a literal is retained for partition pruning, escaping preserves plan-time pruning while closing the injection. Regression tests lock down each vector.\n\n## Workarounds\n\nUntil upgrading: do not pass untrusted input as a dictionary indexer key / `ContainsKey` argument / `Select` constant, nor as a tenant id into projection teardown or provisioning; and disable multi-statement command batching to limit blast radius.\n\n## Credit\n\nReported privately and responsibly by an external security researcher with an executed PoC. Additional sinks found during the follow-up LINQ-wide audit.","summary":"Marten's LINQ provider pasted some runtime values, such as a dictionary indexer key used in a Where filter, into generated SQL inside single-quoted literals without escaping. A value containing a single quote can break out of the literal and run arbitrary SQL, which allows reading or changing other tenants' rows.","severity":"critical","cvss":9.1,"epss":0.00468,"exploited":false,"exploited_at":null,"products":[{"name":"Marten","fixed":["8.37.4"],"affected":">= 7.0.0, < 8.37.4","ecosystem":"nuget"},{"name":"Marten","fixed":["9.13.0"],"affected":">= 9.0.0, < 9.13.0","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["cwe-89","dotnet","marten","multi-tenant","nuget","package","postgresql"],"not_affected_if":["no-user-controlled-keys","static-query-values","versions-patched"],"how_to_check":"- Look for the `Marten` NuGet package in your project files (`*.csproj`, `packages.lock.json`) and note its version.\n- Search your code for LINQ `Where` filters that index a `Dictionary` with a value taken from user input, and for `ContainsKey` calls on such input.\n- Check whether tenant ids or projection names come from request data.","fix":"- `Marten` `8.37.4` for the 8.x line (affected from `7.0.0` up to but not including `8.37.4`)\n- `Marten` `9.13.0` for the 9.x line (affected from `9.0.0` up to but not including `9.13.0`)","status":"open","published_at":"2026-09-16T21:17:13+00:00","first_seen_at":"2026-11-09T16:41:12+00:00","triaged_at":"2026-11-09T16:43:08+00:00","updated_at":"2026-11-09T16:57:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T16:43:08Z","model":"claude-haiku-5-5","output":{"fix":"- `Marten` `8.37.4` for the 8.x line (affected from `7.0.0` up to but not including `8.37.4`)\n- `Marten` `9.13.0` for the 9.x line (affected from `9.0.0` up to but not including `9.13.0`)","reach":"internet","title":"Marten: LINQ filters let crafted dictionary keys inject SQL into queries","impact":"high","summary":"Marten's LINQ provider pasted some runtime values, such as a dictionary indexer key used in a Where filter, into generated SQL inside single-quoted literals without escaping. A value containing a single quote can break out of the literal and run arbitrary SQL, which allows reading or changing other tenants' rows.","audience":"developers","category":"package","nicknames":[],"who_cares":["nuget","marten","postgresql","dotnet","multi-tenant"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads or modifies other tenants' database rows","analyst_note":"","how_to_check":"- Look for the `Marten` NuGet package in your project files (`*.csproj`, `packages.lock.json`) and note its version.\n- Search your code for LINQ `Where` filters that index a `Dictionary` with a value taken from user input, and for `ContainsKey` calls on such input.\n- Check whether tenant ids or projection names come from request data.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["static-query-values","no-user-controlled-keys","versions-patched"],"who_is_affected":"Applications that use Marten's LINQ provider with values an attacker can influence, such as a dictionary indexer key or ContainsKey argument taken from user input, a constant projected in Select, or a tenant id passed to projection teardown or partition provisioning. Applications that only use fixed keys and ids in code are not reachable this way. The sources say the Newtonsoft serializer path is exposed while System.Text.Json escapes the quote for ContainsKey.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000942,"input_tokens":5695,"output_tokens":745,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-75513':14A,22A '-89':26B '0':290C '1':296C,297C,317C,318C '98h7':18A 'addit':417C 'affect':204C 'allow':81B 'also':202C 'applic':193C 'arbitrari':78B,137C 'argument':379C 'attack':106C,292C 'attacker-influenc':105C 'attribut':161C,314C 'audit':428C 'author':181C 'batch':195C,398C 'benign':283C 'bind':334C 'blast':401C 'blind':188C 'break':71B,130C 'bypass':182C 'chang':84B 'claim':251C 'close':356C 'code':89C,248C 'command':397C 'comment':249C 'common':158C 'concept':174C,280C 'confirm':167C,211C 'constant':225C,381C 'contain':66B,125C 'containskey':378C 'could':129C 'credit':403C 'cve':12A,20A 'cwe':25B 'd':311C 'd.data':305C,313C 'data':189C,199C 'ddl':265C 'default':198C 'defens':268C 'defense-in-depth':267C 'deleteallforten':340C 'depth':270C 'dictionari':46B,144C,207C,375C 'dictionary.containskey':214C 'disabl':393C 'doc':308C,309C 'dotnet':27B 'eav':163C 'embed':325C 'escap':63B,120C,220C,324C,349C 'events/daemon/internals/eventloader.cs':266C 'execut':170C,415C 'exfiltr':190C 'exist':331C 'extern':410C 'filter':53B,151C,159C,177C 'fix':320C 'follow':423C 'follow-up':422C 'found':419C 'generat':55B,110C,302C 'ghsa':16A 'ghsa-rfx3-98h7-v3xp':15A 'id':236C,258C,386C 'ieventstore.deleteprojectionprogressasync':244C 'in-cod':246C 'index':47B,145C,208C,376C 'influenc':107C 'inject':7A,136C,358C 'inlin':259C 'input':372C 'insid':57B 'intern':100C 'internal/operations/deleteallfortenant.cs':234C 'interpol':101C 'key':48B,146C,155C,209C,215C,287C,377C 'l':232C 'limit':400C 'linq':3A,37B,94C,426C 'linq-wid':425C 'linq/members/dictionaries/dictionarycontainskeyfilter.cs':213C 'linq/members/dictionaries/dictionaryitemmember.cs':206C 'linq/parsing/selectparser.cs':223C 'liter':11A,61B,75B,118C,134C,277C,343C 'lock':361C 'manag':99C 'marten':1A,23A,24A,28B,35B,92C 'mirror':329C 'modif':200C 'multi':30B,179C,395C 'multi-stat':394C 'multi-ten':29B,178C 'name':162C 'new':231C 'newtonsoft':216C 'nonexist':286C,294C 'nonexistent-key':285C 'npgsql':197C 'nuget':32B 'ordering.buildngramrankexpression':332C 'p0':319C 'packag':33B 'paramet':339C 'parameter':122C 'partit':264C,275C,347C 'partition-prun':274C 'pass':370C 'past':39B 'path':90C 'pattern':164C 'per':239C,272C 'per-ten':238C,271C 'permit':194C 'plan':352C 'plan-tim':351C 'poc':212C,416C 'possibl':203C 'postgresql':34B 'potenti':104C 'preserv':350C 'primari':140C,210C,281C 'privat':405C 'project':227C,241C,388C 'proof':172C,278C 'proof-of-concept':171C 'provid':4A,38B,95C 'provis':391C 'prune':276C,348C,354C 'public.mt':307C 'quot':60B,69B,116C,128C,222C,327C 'radius':402C 'reach':237C 'read':82B 'regress':359C 'replac':328C 'report':404C 'research':412C 'respons':407C 'retain':345C 'return':183C,289C,299C 'rfx3':17A 'row':87B,186C,291C,301C 'run':77B 'runtim':41B,103C 'runtimestr':233C 'schema/databasescopedtenantpartitions.cs':256C 'secur':411C 'select':229C,304C,380C 'serial':217C 'sever':88C 'singl':59B,68B,115C,127C,326C 'single-quot':58B,114C 'sink':205C,322C,418C 'sql':6A,56B,79B,111C,138C,303C 'statement':196C,396C 'string':10A,117C,226C 'system.text.json':219C 'teardown':242C,389C 'tenant':31B,86B,98C,180C,185C,235C,240C,257C,273C,385C 'tenant-manag':97C 'test':360C 'time':353C 'unescap':9A 'untrust':371C 'upgrad':367C 'use':49B,147C 'v':156C,288C,298C 'v3xp':19A 'valid':255C 'valu':42B,65B,108C,124C,253C,262C,336C 'vector':141C,282C,364C 'via':8A,243C 'wide':427C 'without':62B,119C 'workaround':365C 'wrong':250C 'x':153C,230C,315C 'x.attributes':154C,284C,293C 'yield':176C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Marten's LINQ provider with values an attacker can influence, such as a dictionary indexer key or ContainsKey argument taken from user input, a constant projected in Select, or a tenant id passed to projection teardown or partition provisioning. Applications that only use fixed keys and ids in code are not reachable this way. The sources say the Newtonsoft serializer path is exposed while System.Text.Json escapes the quote for ContainsKey.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["marten"],"ptokens":["marten"],"labels":["critical","cwe89","dotnet","marten","multitenant","nuget","package","postgresql"],"campaign_type":null,"search_a":"'-2026':13A,21A '-75513':14A,22A '98h7':18A 'cve':12A,20A 'ghsa':16A 'ghsa-rfx3-98h7-v3xp':15A 'inject':7A 'linq':3A 'liter':11A 'marten':1A,23A,24A 'provid':4A 'rfx3':17A 'sql':6A 'string':10A 'unescap':9A 'v3xp':19A 'via':8A","search_b":"'-89':26B 'allow':81B 'arbitrari':78B 'break':71B 'chang':84B 'contain':66B 'cwe':25B 'dictionari':46B 'dotnet':27B 'escap':63B 'filter':53B 'generat':55B 'index':47B 'insid':57B 'key':48B 'linq':37B 'liter':61B,75B 'marten':28B,35B 'multi':30B 'multi-ten':29B 'nuget':32B 'packag':33B 'past':39B 'postgresql':34B 'provid':38B 'quot':60B,69B 'read':82B 'row':87B 'run':77B 'runtim':41B 'singl':59B,68B 'single-quot':58B 'sql':56B,79B 'tenant':31B,86B 'use':49B 'valu':42B,65B 'without':62B","search_c":"'0':290C '1':296C,297C,317C,318C 'addit':417C 'affect':204C 'also':202C 'applic':193C 'arbitrari':137C 'argument':379C 'attack':106C,292C 'attacker-influenc':105C 'attribut':161C,314C 'audit':428C 'author':181C 'batch':195C,398C 'benign':283C 'bind':334C 'blast':401C 'blind':188C 'break':130C 'bypass':182C 'claim':251C 'close':356C 'code':89C,248C 'command':397C 'comment':249C 'common':158C 'concept':174C,280C 'confirm':167C,211C 'constant':225C,381C 'contain':125C 'containskey':378C 'could':129C 'credit':403C 'd':311C 'd.data':305C,313C 'data':189C,199C 'ddl':265C 'default':198C 'defens':268C 'defense-in-depth':267C 'deleteallforten':340C 'depth':270C 'dictionari':144C,207C,375C 'dictionary.containskey':214C 'disabl':393C 'doc':308C,309C 'eav':163C 'embed':325C 'escap':120C,220C,324C,349C 'events/daemon/internals/eventloader.cs':266C 'execut':170C,415C 'exfiltr':190C 'exist':331C 'extern':410C 'filter':151C,159C,177C 'fix':320C 'follow':423C 'follow-up':422C 'found':419C 'generat':110C,302C 'id':236C,258C,386C 'ieventstore.deleteprojectionprogressasync':244C 'in-cod':246C 'index':145C,208C,376C 'influenc':107C 'inject':136C,358C 'inlin':259C 'input':372C 'intern':100C 'internal/operations/deleteallfortenant.cs':234C 'interpol':101C 'key':146C,155C,209C,215C,287C,377C 'l':232C 'limit':400C 'linq':94C,426C 'linq-wid':425C 'linq/members/dictionaries/dictionarycontainskeyfilter.cs':213C 'linq/members/dictionaries/dictionaryitemmember.cs':206C 'linq/parsing/selectparser.cs':223C 'liter':118C,134C,277C,343C 'lock':361C 'manag':99C 'marten':92C 'mirror':329C 'modif':200C 'multi':179C,395C 'multi-stat':394C 'multi-ten':178C 'name':162C 'new':231C 'newtonsoft':216C 'nonexist':286C,294C 'nonexistent-key':285C 'npgsql':197C 'ordering.buildngramrankexpression':332C 'p0':319C 'paramet':339C 'parameter':122C 'partit':264C,275C,347C 'partition-prun':274C 'pass':370C 'path':90C 'pattern':164C 'per':239C,272C 'per-ten':238C,271C 'permit':194C 'plan':352C 'plan-tim':351C 'poc':212C,416C 'possibl':203C 'potenti':104C 'preserv':350C 'primari':140C,210C,281C 'privat':405C 'project':227C,241C,388C 'proof':172C,278C 'proof-of-concept':171C 'provid':95C 'provis':391C 'prune':276C,348C,354C 'public.mt':307C 'quot':116C,128C,222C,327C 'radius':402C 'reach':237C 'regress':359C 'replac':328C 'report':404C 'research':412C 'respons':407C 'retain':345C 'return':183C,289C,299C 'row':186C,291C,301C 'runtim':103C 'runtimestr':233C 'schema/databasescopedtenantpartitions.cs':256C 'secur':411C 'select':229C,304C,380C 'serial':217C 'sever':88C 'singl':115C,127C,326C 'single-quot':114C 'sink':205C,322C,418C 'sql':111C,138C,303C 'statement':196C,396C 'string':117C,226C 'system.text.json':219C 'teardown':242C,389C 'tenant':98C,180C,185C,235C,240C,257C,273C,385C 'tenant-manag':97C 'test':360C 'time':353C 'untrust':371C 'upgrad':367C 'use':147C 'v':156C,288C,298C 'valid':255C 'valu':108C,124C,253C,262C,336C 'vector':141C,282C,364C 'via':243C 'wide':427C 'without':119C 'workaround':365C 'wrong':250C 'x':153C,230C,315C 'x.attributes':154C,284C,293C 'yield':176C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-08T18:32:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-rfx3-98h7-v3xp","url":"https://github.com/advisories/GHSA-rfx3-98h7-v3xp","severity":"critical","published_at":"2026-09-17T14:51:41+00:00","modified_at":"2026-11-09T16:39:14+00:00","first_seen_at":"2026-11-09T16:41:12+00:00","fetched_at":"2026-11-09T16:51:33+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-75513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75513","severity":null,"published_at":"2026-09-16T21:17:13+00:00","modified_at":"2026-09-19T02:16:54+00:00","first_seen_at":"2026-11-09T16:57:34+00:00","fetched_at":"2026-11-09T16:57:34+00:00","note":null}],"documents":[{"id":108337,"url":"https://api.github.com/repos/JasperFx/marten/security-advisories/GHSA-rfx3-98h7-v3xp","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":108338,"url":"https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-07-08T18:32:42+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":108339,"url":"https://github.com/JasperFx/marten/pull/4911","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108340,"url":"https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108341,"url":"https://github.com/JasperFx/marten/releases/tag/9.13.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":108342,"url":"https://github.com/JasperFx/marten/releases/tag/8.37.4","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00468,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75513"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}