{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/marten/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:marten:marten:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:marten:marten:9.12.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-75513"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Marten (7.0.0 - 9.12.0)"],"_cs_severities":["critical"],"_cs_tags":["marten","sql-injection","cve-2026-75513","dotnet","database-security"],"_cs_type":"advisory","_cs_vendors":["Marten"],"content_html":"\u003cp\u003eMarten, a document database library for .NET using PostgreSQL, contains multiple SQL injection vulnerabilities (CVE-2026-75513) stemming from improper handling of runtime-influenced string inputs. The LINQ provider and tenant management internal components interpolate unsanitized strings directly into SQL queries as single-quoted literals. An attacker can break out of these literals by supplying input containing single quotes, leading to arbitrary SQL execution.\u003c/p\u003e\n\u003cp\u003eThe primary attack vector involves supplying malicious dictionary keys within LINQ \u003ccode\u003eWhere\u003c/code\u003e filters (e.g., \u003ccode\u003ex.Attributes[key] == v\u003c/code\u003e), enabling filter bypass and unauthorized cross-tenant data access. Additional vulnerable sinks include \u003ccode\u003eDictionary.ContainsKey\u003c/code\u003e calls, projection selectors, tenant ID parameters in projection teardown, and DDL generation for database-scoped tenant partitions. If the application environment allows \u003ccode\u003e;\u003c/code\u003e delimited multi-statement queries, which is the default behavior of the underlying Npgsql driver, this vulnerability can facilitate data modification or destruction. Defenders should prioritize upgrading to patched versions immediately and audit code paths that pass user-supplied input to dictionary indexers or tenant-related functions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application endpoint that uses user-supplied input as a key in a Marten \u003ccode\u003eDictionary\u0026lt;,\u0026gt;\u003c/code\u003e indexer within a LINQ \u003ccode\u003eWhere\u003c/code\u003e filter.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a payload containing a single quote character designed to terminate the SQL string literal and append malicious SQL logic.\u003c/li\u003e\n\u003cli\u003eThe Marten LINQ provider receives the payload and interpolates the string into the generated SQL query without parameterization or escaping.\u003c/li\u003e\n\u003cli\u003eThe query is transmitted to the PostgreSQL database, where the injected SQL fragment executes with the privileges of the application's database user.\u003c/li\u003e\n\u003cli\u003eThe injection modifies the query logic, such as appending \u003ccode\u003eor 1=1 --\u003c/code\u003e, effectively bypassing intended filter conditions or tenant isolation boundaries.\u003c/li\u003e\n\u003cli\u003eThe database returns unauthorized records from other tenants or reveals sensitive data through blind SQL injection techniques.\u003c/li\u003e\n\u003cli\u003eIf multi-statement support is enabled, the attacker injects a second statement (e.g., \u003ccode\u003e'; DROP TABLE... --\u003c/code\u003e) to perform data modification or destructive actions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to a total compromise of data confidentiality within the affected PostgreSQL database. Attackers can bypass multi-tenancy controls to access data across different partitions, perform blind exfiltration of sensitive information, or potentially execute data modification/deletion attacks. The vulnerability affects a wide range of Marten versions (v7.0.0 through v9.12.0), posing a critical risk to any application relying on these library functions for dynamic filtering or multi-tenant management.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Marten to a patched version immediately.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, identify and sanitize all instances where user-controlled input is passed as a key to dictionary indexers (\u003ccode\u003eWhere\u003c/code\u003e filters) or arguments to \u003ccode\u003eDictionary.ContainsKey\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRestrict the use of user-supplied input in \u003ccode\u003eSelect\u003c/code\u003e projection constants or tenant ID arguments within projection teardown functions.\u003c/li\u003e\n\u003cli\u003eDisable support for multi-statement command batching in the Npgsql connection string to limit the impact of potential SQL injection payloads.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and allow-listing for any string intended to be used as a dictionary key or tenant identifier in the data access layer.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-17T19:10:05Z","date_published":"2026-09-17T19:10:05Z","id":"https://feed.craftedsignal.io/briefs/2026-09-marten-sql-injection/","summary":"Marten versions 7.0.0 through 9.12.0 contain critical SQL injection vulnerabilities in the LINQ provider and tenant-management internals, allowing attackers to perform unauthorized data access, multi-tenant bypass, and data modification via crafted dictionary keys or tenant IDs.","title":"SQL Injection in Marten LINQ Provider via Unescaped Literals","url":"https://feed.craftedsignal.io/briefs/2026-09-marten-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Marten","version":"https://jsonfeed.org/version/1.1"}