Marten's LINQ provider has SQL injection via unescaped string literals

JasperFx marten

Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote (') could break out of the literal and inject arbitrary SQL.

First seen: 17 Sept 2026
Last update: 17 Sept 2026, 14:51 UTC
Versions per GitHub advisory, not the vendor: Marten 9.13.0
Marten 8.37.4
Identifiers: CVE-2026-75513
CVSS: 9.1
Source: GitHub advisory

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Marten's LINQ provider has SQL injection via unescaped string literals
Severity: critical. Patch status: fix status unknown.
Affected: JasperFx marten
Versions per GitHub advisory, not the vendor: Marten 9.13.0, Marten 8.37.4
Ids: CVE-2026-75513

Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote (') could break out of the literal and inject arbitrary SQL.

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `Marten`. For each hit, compare the installed version with the version on the same major line (per GitHub advisory, not the vendor, so check the vendor's advisory before treating it as a fix): Marten 9.13.0, Marten 8.37.4. If it's lower, give the exact upgrade command for the package manager this repo uses.
2. Versions per GitHub advisory, not the vendor: Marten: 9.0.x → 9.13.0; >= 7.0.0 < 8.37.4 → 8.37.4. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Marten 9.0.x | per GitHub advisory, not the vendor | 9.13.0 | restrict network access to it |
| Marten >= 7.0.0 < 8.37.4 | per GitHub advisory, not the vendor | 8.37.4 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-75513") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed https://github.com/JasperFx/marten/pull/4911 https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp https://github.com/advisories/GHSA-rfx3-98h7-v3xp https://nvd.nist.gov/vuln/detail/CVE-2026-75513
https://pwned.coffee/i/marten-s-linq-provider-has-sql-injection-via-unescaped-s-cve-2026-75513

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-75513 "poc" (SSVC).” source
By release line, per GitHub advisory, not the vendor: Product Affected Version named Source
Marten (nuget) >= 9.0.0, < 9.13.0 9.13.0 GitHub advisory per GitHub advisory, not the vendor checked 9 Nov
Marten (nuget) >= 7.0.0, < 8.37.4 8.37.4 GitHub advisory per GitHub advisory, not the vendor checked 9 Nov
Score: CVSS 9.1 (critical). CVSS 3.1 9.1 (CNA GitHub_M) for CVE-2026-75513
Last checked: 9 Nov 2026, 17:17 UTC

Product	Affected	Version named	Source
Marten (nuget)	>= 9.0.0, < 9.13.0	9.13.0	GitHub advisory per GitHub advisory, not the vendor checked 9 Nov
Marten (nuget)	>= 7.0.0, < 8.37.4	8.37.4	GitHub advisory per GitHub advisory, not the vendor checked 9 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee