{"id":"EUVD-2026-81263","revision":"b1b2d5f8dca34f56b9c95bc4e002de16","records":[{"revision":"b1b2d5f8dca34f56b9c95bc4e002de16","observedAt":"2026-11-05T13:43:23.539+00:00","statement":{"source":"euvd","id":"EUVD-2026-81263","aliases":["CVE-2026-75513","GHSA-rfx3-98h7-v3xp"],"title":"Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL l…","description":"Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","score":9.1,"severity":null}],"references":["https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp","https://github.com/JasperFx/marten/pull/4911","https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed","https://github.com/JasperFx/marten/releases/tag/9.13.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81263","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 16, 2026, 8:46:17 PM","dateUpdated":"Sep 19, 2026, 1:55:24 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-81263","identifiers":["EUVD-2026-81263","CVE-2026-75513","GHSA-rfx3-98h7-v3xp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}