CVE-2026-75513 JasperFx CVE debrief

Who should care

Defenders and administrators responsible for Marten deployments, particularly those using versions between 7.0.0 and 9.12.0, should assess exposure and prioritize remediation. This includes reviewing system configurations, monitoring for suspicious activity, and applying compensating controls if necessary. Security teams and vulnerability management teams should also be aware of the potential risks and take steps to mitigate them.

Why it matters

CVE-2026-75513 is a critical vulnerability in Marten that requires immediate attention from defenders and administrators. The vulnerability allows for potential SQL injection attacks, which could lead to filter or multi-tenant authorization bypass and blind data exfiltration. Affected deployments should be updated to version 9.13.0 or later, and compensating controls should be considered if necessary.

• Potential SQL injection attacks
• Filter or multi-tenant authorization bypass
• Blind data exfiltration through crafted SQL queries
• Possible data modification if semicolon-batched Npgsql statements are permitted

Technical summary

The vulnerability exists in Marten's LINQ and tenant-management paths, where runtime strings are interpolated into single-quoted SQL literals without escaping or parameterization. This could allow attackers to inject malicious SQL code, potentially leading to filter or multi-tenant authorization bypass and blind data exfiltration. The primary confirmed vector is a dictionary indexer key used by Where filters. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal. A crafted single quote can escape the generated literal, enabling filter or multi-tenant The fix

Defensive priority

High

Recommended defensive actions

• Review and update Marten to version 9.13.0 or later
• Assess exposure and prioritize remediation for affected deployments
• Monitor for potential SQL injection attacks
• Verify inventory and apply compensating controls if necessary
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The Marten project's GitHub repository contains additional information on the fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.