CVE-2026-75513
- Source
- https://cve.org/CVERecord?id=CVE-2026-75513
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75513.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-75513
- Aliases
- Published
- 2026-09-16T20:46:17Z
- Modified
- 2026-09-18T03:48:30Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L CVSS Calculator
- Summary
- Marten: SQL injection in Marten's LINQ provider via unescaped string literals
- Details
-
Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-89" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75513.json" }- References
-
- https://github.com/JasperFx/marten/releases/tag/9.13.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75513.json
- https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp
- https://nvd.nist.gov/vuln/detail/CVE-2026-75513
- https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed
- https://github.com/JasperFx/marten/pull/4911