{"id":"EUVD-2026-81263","enisaUuid":"70204350-ef14-3d91-b354-8dbb7e74f7ff","description":"Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.","datePublished":"Sep 16, 2026, 8:46:17 PM","dateUpdated":"Sep 19, 2026, 1:55:24 AM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp\nhttps://github.com/JasperFx/marten/pull/4911\nhttps://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed\nhttps://github.com/JasperFx/marten/releases/tag/9.13.0\n","aliases":"CVE-2026-75513\nGHSA-rfx3-98h7-v3xp\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"5e319c0c-193b-32e0-97af-9b02cf35699e","product":{"name":"marten","vendor":{"name":"JasperFx"}},"product_version":"7.0.0, \u003c 9.13.0"}],"enisaIdVendor":[{"id":"589f6f14-f644-339d-86ed-b684c4616fa4","vendor":{"name":"JasperFx"}}],"enisaIdVulnerability":[{"id":"76890c97-42b7-3037-86d3-88737548bff6","vulnerability":{"id":"CVE-2026-75513","description":"Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.","datePublished":"Sep 16, 2026, 8:46:17 PM","dateUpdated":"Sep 19, 2026, 1:55:24 AM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp\nhttps://github.com/JasperFx/marten/pull/4911\nhttps://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed\nhttps://github.com/JasperFx/marten/releases/tag/9.13.0\n","enisa_id":"EUVD-2026-81263\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Nov 5, 2026, 7:15:27 AM","vulnerabilityProduct":[{"id":"6f346cc3-98fd-3b8a-b403-5e1fb94703c6","product":{"name":"marten","vendor":{"name":"JasperFx"}},"product_version":"7.0.0, \u003c 9.13.0"}],"vulnerabilityVendor":[{"id":"d3c1d779-c50b-32ce-bf9c-3a09969f8f8c","vendor":{"name":"JasperFx"}}]}},{"id":"c5f7e03d-777f-3632-92e9-28e5a52ee94f","vulnerability":{"id":"GHSA-rfx3-98h7-v3xp","description":"Marten\u0027s LINQ provider has SQL injection via unescaped string literals","datePublished":"Sep 17, 2026, 2:51:41 PM","dateUpdated":"Sep 17, 2026, 2:51:41 PM","baseScore":0.0,"references":"https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-75513\nhttps://github.com/JasperFx/marten/pull/4911\nhttps://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed\nhttps://github.com/JasperFx/marten\nhttps://github.com/JasperFx/marten/releases/tag/9.13.0\n","enisa_id":"EUVD-2026-81263\n","aliases":"GHSA-rfx3-98h7-v3xp\nCVE-2026-75513\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}