CVE-2026-75513

Marten, a .NET transactional document database and event store built on PostgreSQL, fails to escape or parameterize runtime strings interpolated into single-quoted SQL literals in versions 7.0.0 through before 9.13.0. The confirmed injection point is the dictionary indexer key used by LINQ Where filters (DictionaryItemMember.cs), with additional sinks in SelectParser.cs, DatabaseScopedTenantPartitions.cs, DeleteAllForTenant.cs (reachable via IEventStore.DeleteProjectionProgressAsync), the Newtonsoft-serializer-only DictionaryContainsKeyFilter.cs (System.Text.Json is not affected), and a defense-in-depth per-tenant partition literal in EventLoader.cs. An attacker who controls a value containing a single quote — for example a dictionary key used in a query filter or a tenant identifier — can break out of the generated literal to bypass query filters or multi-tenant authorization and perform blind data exfiltration. Where the deployment permits semicolon-batched Npgsql statements, the injection can extend to data modification. Any application built with Marten 7.0.0–9.12.x on PostgreSQL, particularly multi-tenant apps that pass attacker-influenced keys or tenant IDs into LINQ queries, is affected; no public PoC exists, it is not in CISA KEV, and exploitation is not known to date.

What to do: Upgrade to Marten 9.13.0 or later. Until patched, validate/escape single quotes in values used as dictionary indexer keys in Where filters and in tenant identifiers, avoid enabling semicolon-batched Npgsql statements, and audit multi-tenant query paths (select parsing, tenant partition management, DeleteAllForTenant/DeleteProjectionProgressAsync); note the ContainsKey sink applies only when the Newtonsoft serializer is used.