CVE-2026-75513 Marten: SQL injection in Marten's LINQ provider via unescaped string literals
Attackers can inject SQL via LINQ filters to bypass authorization and exfiltrate or modify data in Marten-based applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75513?
CVE-2026-75513 is a critical SQL injection vulnerability in JasperFx marten, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-75513?
2 open source packages ship an affected version, including Marten.
| Package | Affected | Fixed in |
|---|---|---|
Marten NuGet | From 7.0.0 | 9.13.0 |
Marten NuGet | From 7.0.0 | 9.13.0 |
How do I fix CVE-2026-75513?
Upgrade Marten to 9.13.0 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-75513 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75513 exists.
Sources
Also known as GHSA-rfx3-98h7-v3xp.