Marten: SQL injection in Marten's LINQ provider via unescaped string literals

Summary

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.

Timeline

1. Sep 16, 2026, 8:46 PM UTCCVE published
2. Sep 19, 2026, 1:54 AM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: partial

3. Sep 19, 2026, 1:55 AM UTCRecord last updated

Affected versions

• JasperFx marten

  From 7.0.0 · fixed in 9.13.0

• MartenNuGet

  From 7.0.0 · fixed in 9.13.0

References 4