CVE-2026-75513: Marten SQL Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rfx3-98h7-v3xp",
  "modified" : "2026-09-17T14:51:41Z",
  "published" : "2026-09-17T14:51:41Z",
  "aliases" : [ "CVE-2026-75513" ],
  "summary" : "Marten's LINQ provider has SQL injection via unescaped string literals",
  "details" : "Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote (`'`) could break out of the literal and inject arbitrary SQL.\n\nThe primary vector is a `Dictionary<,>` indexer **key** used in a `Where` filter — `Where(x => x.Attributes[key] == v)` — a common \"filter by attribute name\" / EAV pattern. It is confirmed with an executed proof-of-concept and yields filter / multi-tenant authorization bypass (returning other tenants' rows) and blind data exfiltration. Where the application permits `;`-batched statements (Npgsql default), data modification is also possible.\n\n## Affected sinks\n\n- `Linq/Members/Dictionaries/DictionaryItemMember.cs` — dictionary indexer key (primary, confirmed PoC)\n- `Linq/Members/Dictionaries/DictionaryContainsKeyFilter.cs` — `Dictionary.ContainsKey(key)` (Newtonsoft serializer only; System.Text.Json escapes the quote)\n- `Linq/Parsing/SelectParser.cs` — a constant string projected through `Select(x => new { L = runtimeString })`\n- `Internal/Operations/DeleteAllForTenant.cs` — tenant id reaching per-tenant projection teardown via `IEventStore.DeleteProjectionProgressAsync` (an in-code comment wrongly claimed the value was validated)\n- `Schema/DatabaseScopedTenantPartitions.cs` — tenant id inlined into `FOR VALUES IN ('...')` partition DDL\n- `Events/Daemon/Internals/EventLoader.cs` (defense-in-depth) — per-tenant partition-pruning literal\n\n## Proof of concept (primary vector)\n\nBenign: `x.Attributes[\"nonexistent-key\"] == \"v\"` returns 0 rows. Attack: `x.Attributes[\"nonexistent' = '' or 1=1 --\"] == \"v\"` returns all rows. Generated SQL:\n\n```\nselect d.data from public.mt_doc_doc as d where d.data -> 'Attributes' ->> 'x' or 1=1 --' = :p0;\n```\n\n## Fix\n\nEach sink now escapes embedded single quotes (`.Replace(\"'\", \"''\")`, mirroring the existing `Ordering.BuildNgramRankExpression`) or binds the value as a parameter (`DeleteAllForTenant`). Where a literal is retained for partition pruning, escaping preserves plan-time pruning while closing the injection. Regression tests lock down each vector.\n\n## Workarounds\n\nUntil upgrading: do not pass untrusted input as a dictionary indexer key / `ContainsKey` argument / `Select` constant, nor as a tenant id into projection teardown or provisioning; and disable multi-statement command batching to limit blast radius.\n\n## Credit\n\nReported privately and responsibly by an external security researcher with an executed PoC. Additional sinks found during the follow-up LINQ-wide audit.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Marten"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "9.13.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 9.12.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-75513"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/JasperFx/marten/pull/4911"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/JasperFx/marten"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/JasperFx/marten/releases/tag/9.13.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-89" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-17T14:51:41Z",
    "nvd_published_at" : "2026-09-16T21:17:13Z"
  }
}