{"id":"CVE-2026-75513","aliases":["GHSA-rfx3-98h7-v3xp"],"url":"https://o3.security/vulnerability/CVE-2026-75513","summary":"Marten: SQL injection in Marten's LINQ provider via unescaped string literals","details":"Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote (`'`) could break out of the literal and inject arbitrary SQL.\n\nThe primary vector is a `Dictionary<,>` indexer **key** used in a `Where` filter — `Where(x => x.Attributes[key] == v)` — a common \"filter by attribute name\" / EAV pattern. It is confirmed with an executed proof-of-concept and yields filter / multi-tenant authorization bypass (returning other tenants' rows) and blind data exfiltration. Where the application permits `;`-batched statements (Npgsql default), data modification is also possible.\n\n## Affected sinks\n\n- `Linq/Members/Dictionaries/DictionaryItemMember.cs` — dictionary indexer key (primary, confirmed PoC)\n- `Linq/Members/Dictionaries/DictionaryContainsKeyFilter.cs` — `Dictionary.ContainsKey(key)` (Newtonsoft serializer only; System.Text.Json escapes the quote)\n- `Linq/Parsing/SelectParser.cs` — a constant string projected through `Select(x => new { L = runtimeString })`\n- `Internal/Operations/DeleteAllForTenant.cs` — tenant id reaching per-tenant projection teardown via `IEventStore.DeleteProjectionProgressAsync` (an in-code comment wrongly claimed the value was validated)\n- `Schema/DatabaseScopedTenantPartitions.cs` — tenant id inlined into `FOR VALUES IN ('...')` partition DDL\n- `Events/Daemon/Internals/EventLoader.cs` (defense-in-depth) — per-tenant partition-pruning literal\n\n## Proof of concept (primary vector)\n\nBenign: `x.Attributes[\"nonexistent-key\"] == \"v\"` returns 0 rows. Attack: `x.Attributes[\"nonexistent' = '' or 1=1 --\"] == \"v\"` returns all rows. Generated SQL:\n\n```\nselect d.data from public.mt_doc_doc as d where d.data -> 'Attributes' ->> 'x' or 1=1 --' = :p0;\n```\n\n## Fix\n\nEach sink now escapes embedded single quotes (`.Replace(\"'\", \"''\")`, mirroring the existing `Ordering.BuildNgramRankExpression`) or binds the value as a parameter (`DeleteAllForTenant`). Where a literal is retained for partition pruning, escaping preserves plan-time pruning while closing the injection. Regression tests lock down each vector.\n\n## Workarounds\n\nUntil upgrading: do not pass untrusted input as a dictionary indexer key / `ContainsKey` argument / `Select` constant, nor as a tenant id into projection teardown or provisioning; and disable multi-statement command batching to limit blast radius.\n\n## Credit\n\nReported privately and responsibly by an external security researcher with an executed PoC. Additional sinks found during the follow-up LINQ-wide audit.","published":"2026-09-16T20:46:17.189Z","modified":"2026-10-28T02:31:03.184387667Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"},"epss":{"score":0.00352,"percentile":0.2871,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"Marten","fixedVersion":"9.13.0"}],"fix":{"url":"https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed","label":"JasperFx/marten@61882d0"},"references":[{"type":"WEB","url":"https://github.com/JasperFx/marten/releases/tag/9.13.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75513.json"},{"type":"ADVISORY","url":"https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75513"},{"type":"FIX","url":"https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed"},{"type":"FIX","url":"https://github.com/JasperFx/marten/pull/4911"},{"type":"PACKAGE","url":"https://github.com/JasperFx/marten"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:03.184387667Z"}}