9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-75513

CVE-2026-75513: Marten: SQL injection in Marten's LINQ provider via unescaped string literals

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-75513

CVE-2026-75513:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Marten	nuget	>= 7.0.0, <= 9.12.0	9.13.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-75513, is a series of SQL injection flaws within the Marten LINQ provider and tenant management internals. The root cause is the interpolation of un-sanitized, and potentially attacker-controlled, string values directly into SQL queries. These values, when containing a single quote ('), could be used to break out of the string literal and inject arbitrary SQL commands. The analysis of the patch commit 61882d0424854cb48703f08bdb246894ac576bed confirms this. The patch consistently applies fixes by either escaping single quotes in the interpolated strings (e.g., .Replace("'", "''")) or by converting the vulnerable parts of the query to use parameterized statements, which is a standard defense against SQL injection. The identified vulnerable functions are the ones that were modified to apply these fixes, as they were the locations where the unsafe string interpolation occurred.

Vulnerable functions

Marten.Events.Daemon.Internals.EventLoader.EventLoader

src/Marten/Events/Daemon/Internals/EventLoader.cs

The constructor of `EventLoader` directly interpolated the `TenantFilterValue` into a SQL query without escaping, making it vulnerable to SQL injection. An attacker could provide a crafted tenant ID to bypass tenant isolation.

Marten.Events.Daemon.Internals.EventLoader.loadWithSkipAheadAsync

src/Marten/Events/Daemon/Internals/EventLoader.cs

The `loadWithSkipAheadAsync` method directly interpolated the `TenantFilterValue` into a SQL query without escaping. This could allow an attacker to inject malicious SQL through a crafted tenant ID, leading to data exfiltration or unauthorized data access.

Marten.Internal.Operations.DeleteAllForTenant.ConfigureCommand

src/Marten/Internal/Operations/DeleteAllForTenant.cs

The `ConfigureCommand` method in `DeleteAllForTenant` constructed a SQL DELETE statement by concatenating the `_tenantId` directly into the query string. This is a classic SQL injection vulnerability. The fix correctly uses a parameterized query.

Marten.Linq.Members.Dictionaries.DictionaryContainsKeyFilter.Apply

src/Marten/Linq/Members/Dictionaries/DictionaryContainsKeyFilter.cs

The `Apply` method in `DictionaryContainsKeyFilter` was vulnerable to SQL injection because it used the `_keyText` directly in a JSON-path literal without escaping single quotes. This could allow an attacker to break out of the literal and inject arbitrary SQL.

Marten.Linq.Members.Dictionaries.DictionaryItemMember.DictionaryItemMember

src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs

The constructor for `DictionaryItemMember` directly used the `key` in a string to build a JSON-path locator. Since the key is a runtime value, it could be controlled by an attacker to inject SQL. The fix escapes the single quotes in the key.

Marten.Linq.Parsing.SelectParser.VisitConstant

src/Marten/Linq/Parsing/SelectParser.cs

The `VisitConstant` method in `SelectParser` was vulnerable because it wrapped a string constant in single quotes without escaping its content. An attacker could provide a crafted string that breaks out of the quotes and injects SQL.

Marten.Schema.DatabaseScopedTenantPartitions.Partitions

src/Marten/Schema/DatabaseScopedTenantPartitions.cs

The `Partitions` method in `DatabaseScopedTenantPartitions` created list partitions by wrapping tenant IDs in single quotes without escaping. This could allow for SQL injection in a SaaS auto-provisioning scenario where tenant IDs might be attacker-influenced.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.