GHSA-rfx3-98h7-v3xp
Suggest an improvement- Source
- https://github.com/advisories/GHSA-rfx3-98h7-v3xp
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-rfx3-98h7-v3xp/GHSA-rfx3-98h7-v3xp.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-rfx3-98h7-v3xp
- Aliases
- Published
- 2026-09-17T14:51:41Z
- Modified
- 2026-09-17T15:00:07Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L CVSS Calculator
- Summary
- Marten's LINQ provider has SQL injection via unescaped string literals
- Details
-
Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote (
') could break out of the literal and inject arbitrary SQL.The primary vector is a
Dictionary<,>indexer key used in aWherefilter —Where(x => x.Attributes[key] == v)— a common "filter by attribute name" / EAV pattern. It is confirmed with an executed proof-of-concept and yields filter / multi-tenant authorization bypass (returning other tenants' rows) and blind data exfiltration. Where the application permits;-batched statements (Npgsql default), data modification is also possible.Affected sinks
Linq/Members/Dictionaries/DictionaryItemMember.cs— dictionary indexer key (primary, confirmed PoC)Linq/Members/Dictionaries/DictionaryContainsKeyFilter.cs—Dictionary.ContainsKey(key)(Newtonsoft serializer only; System.Text.Json escapes the quote)Linq/Parsing/SelectParser.cs— a constant string projected throughSelect(x => new { L = runtimeString })Internal/Operations/DeleteAllForTenant.cs— tenant id reaching per-tenant projection teardown viaIEventStore.DeleteProjectionProgressAsync(an in-code comment wrongly claimed the value was validated)Schema/DatabaseScopedTenantPartitions.cs— tenant id inlined intoFOR VALUES IN ('...')partition DDLEvents/Daemon/Internals/EventLoader.cs(defense-in-depth) — per-tenant partition-pruning literal
Proof of concept (primary vector)
Benign:
x.Attributes["nonexistent-key"] == "v"returns 0 rows. Attack:x.Attributes["nonexistent' = '' or 1=1 --"] == "v"returns all rows. Generated SQL:select d.data from public.mt_doc_doc as d where d.data -> 'Attributes' ->> 'x' or 1=1 --' = :p0;Fix
Each sink now escapes embedded single quotes (
.Replace("'", "''"), mirroring the existingOrdering.BuildNgramRankExpression) or binds the value as a parameter (DeleteAllForTenant). Where a literal is retained for partition pruning, escaping preserves plan-time pruning while closing the injection. Regression tests lock down each vector.Workarounds
Until upgrading: do not pass untrusted input as a dictionary indexer key /
ContainsKeyargument /Selectconstant, nor as a tenant id into projection teardown or provisioning; and disable multi-statement command batching to limit blast radius.Credit
Reported privately and responsibly by an external security researcher with an executed PoC. Additional sinks found during the follow-up LINQ-wide audit.
- Database specific
{ "cwe_ids": [ "CWE-89" ], "github_reviewed": true, "github_reviewed_at": "2026-09-17T14:51:41Z", "nvd_published_at": "2026-09-16T21:17:13Z", "severity": "CRITICAL" }- References
-
- https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp
- https://nvd.nist.gov/vuln/detail/CVE-2026-75513
- https://github.com/JasperFx/marten/pull/4911
- https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed
- https://github.com/JasperFx/marten
- https://github.com/JasperFx/marten/releases/tag/9.13.0
Affected packages
NuGet / Marten
Package
- Name
- Marten
- View open source insights on deps.dev
- Purl
- pkg:nuget/Marten