CVE-2026-75513

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.

• CWE-89

• https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed
• https://github.com/JasperFx/marten/pull/4911
• https://github.com/JasperFx/marten/releases/tag/9.13.0
• https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp
• https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp

Published

Sep 16, 2026

Last Modified

Sep 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7550A vulnerability has been found in SourceCodester Pharmacy Sa…7.3
• CVE-2026-75501Rejected reason: Vendor could not replicate the vul, and rep…
• CVE-2026-75509joserfc is a Python library that provides an implementation …6.5
• CVE-2026-7551HKUDS OpenHarness contains a remote code execution vulnerabi…8.8
• CVE-2026-75510Novu provides an API for sending notifications through multi…5.1
• CVE-2026-75511Novu provides an API for sending notifications through multi…5.3
• CVE-2026-75514BunkerWeb is an open-source, next-generation Web Application…5.9
• CVE-2026-75516The RabbitMQ Java client library allows Java and JVM-based a…8.7
• CVE-2026-75517Novu provides an API for sending notifications through multi…6.5
• CVE-2026-7552The Geo Mashup plugin for WordPress is vulnerable to authori…5.3
• CVE-2026-75523Steeltoe is an open source project that provides a collectio…5.9
• CVE-2026-75526django CMS is an easy-to-use and developer-friendly enterpri…4.4