Executive brief
Marten is a document database for .NET that uses LINQ queries to generate SQL. The vulnerability allows attackers to inject arbitrary SQL by crafting malicious input—such as dictionary keys or tenant IDs—that contain single quotes. An attacker with low privileges can exploit this to read unauthorized data, bypass multi-tenant access controls, and potentially modify data, affecting the confidentiality and integrity of customer information.
Technical details
This SQL injection vulnerability (CWE-89) stems from unsafe string interpolation in six code paths across Marten's LINQ provider and tenant management logic. The primary vector is the dictionary indexer pattern Where(x => x.Attributes[key] == v), where the attacker-controlled key is directly embedded into generated SQL as a single-quoted string literal without escaping. A key containing a single quote (e.g., "nonexistent' = '' or 1=1 --") can break out of the literal and inject arbitrary SQL predicates. The vulnerability requires only low-privilege user access (PR:L) and no user interaction; it is network-reachable. Secondary injection points exist in DictionaryContainsKeyFilter, Select projections, tenant ID handling in DeleteAllForTenant, partition DDL generation, and event loader pruning. Where the database allows semicolon-batched statements (default in Npgsql), attackers can perform blind data exfiltration and, in some cases, data modification. Patched versions (9.13.0+) apply single-quote escaping or parameter binding at each sink; workarounds include avoiding untrusted input in these contexts and disabling multi-statement batching.
Affected products
- JasperFx Marten 7.0.0 through 9.12.0
Timeline
- 2026-09-17: disclosed: GitHub Security Advisory GHSA-rfx3-98h7-v3xp published
- 2026-09-17: patched: Marten 9.13.0 released with fixes
- 2026-07-08: other: CVE-2026-75513 assigned; private disclosure and responsible reporting preceded public advisory