Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-75513: Marten can run unauthorized database commands with crafted input

CVE-2026-75513 · published 1 month ago

Summary

Versions of the Martian document database from 7.0.0 through 9.13.0 build SQL statements using some user‑supplied text without proper safety checks. An attacker could insert a single quote to change the query, potentially bypassing filters or reading data they should not see, and in some setups could also alter data. Upgrade Marten to version 9.13.0 or later to apply the fix.

What to do

Update marten to version 9.13.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	jasperfx	marten	>= 7.0.0, < 9.13.0
nuget	–	marten	>= 7.0.0, <= 9.12.0 Fix: upgrade to 9.13.0
NuGet	–	marten	>= 7.0.0, < 9.13.0 Fix: upgrade to 9.13.0

Original advisory text

Marten: SQL injection in Marten's LINQ provider via unescaped string literals

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.

References

https://github.com/JasperFx/marten/releases/tag/9.13.0 URL
https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp Vendor Advisory
https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576b... Patch
https://github.com/JasperFx/marten/pull/4911 Patch
https://nvd.nist.gov/vuln/detail/CVE-2026-75513 Vendor Advisory
https://github.com/advisories/GHSA-rfx3-98h7-v3xp
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75513... Vendor Advisory
https://github.com/JasperFx/marten Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published16 Sep 2026

Updated4 Nov 2026

First seen16 Sep 2026

Sources

CVE-2026-75513 · NVD

CVE-2026-75513 · MITRE

GHSA-rfx3-98h7-v3xp · GHSA

CVE-2026-75513 · OSV

GHSA-rfx3-98h7-v3xp · OSV

Track software like this

Free during beta