SQL Injection Vulnerability in Marten Document Database by JasperFx
CVE-2026-75513

9.1CRITICAL

Key Information:

Vendor

Jasperfx

Status
Marten
Vendor
CVE Published:
16 September 2026

What is CVE-2026-75513?

The vulnerability in Marten, a .NET transactional document database, arises from improper handling of user input, allowing attacker-controlled strings to be interpolated into SQL literals without necessary escaping or parameterization. This issue primarily affects LINQ queries and tenant management paths, potentially leading to unauthorized access, data exfiltration, or manipulation when proper safeguards are not in place. Specific components like DictionaryItemMember.cs, SelectParser.cs, and DatabaseScopedTenantPartitions.cs are involved in this risk. It is crucial for users to upgrade to version 9.13.0 or later to mitigate this security concern.

Affected Version(s)

marten >= 7.0.0, < 9.13.0

References

https://github.com/JasperFx/marten/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/JasperFx/marten/pull/4911
x_refsource_MISC
https://github.com/JasperFx/marten/commit/61882d0424854cb...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.