Marten EUVD-2026-81263

Exploitation requires the host application to pass attacker-controlled strings into one of the affected Marten paths: the primary confirmed vector is a dictionary indexer key used in Where filters (DictionaryItemMember.cs); Dictionary.ContainsKey is exploitable ONLY when the Newtonsoft serializer is configured (System.Text.Json is not affected); and tenant identifiers reaching DeleteAllForTenant.cs via IEventStore.DeleteProjectionProgressAsync. Limiting factors: the vulnerable strings must be reachable from untrusted input (a library/application-integration prerequisite), the CVSS PR:L implies an authenticated context, and DATA MODIFICATION (beyond read/authorization bypass) is possible only on deployments that permit semicolon-batched Npgsql statements - a non-default multi-statement configuration. Read-based filter/multi-tenant authorization bypass and blind exfiltration do not require the batched-statement setting.

This is a genuine high-priority SQL injection (CWE-89) in Marten, confirmed by the vendor's own GitHub Security Advisory (GHSA-rfx3-98h7-v3xp) and fixed in 9.13.0 via PR #4911 with dedicated regression tests. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, 9.1) signals a network-reachable, low-complexity flaw whose scope-change (S:C) reflects cross-tenant authorization bypass - an attacker reading data belonging to other tenants, which is the most serious real-world consequence. Confidentiality is High while Integrity/Availability are Low because write/delete impact is conditional (only where semicolon-batched Npgsql statements are permitted, a non-default connection setting). No EPSS score, no CISA KEV listing, and no standalone public exploit were provided, so there is no evidence of active exploitation; however, the PR #4911 regression tests embed working attack payloads (e.g. "nonexistent' = '' or 1=1 --", "x' or '1'='1"), which materially lowers the barrier to weaponization. The one caveat is the PR:L rating: exploitability depends entirely on whether the host application routes attacker-controlled input into the affected LINQ dictionary-indexer/ContainsKey or tenant-management paths - a library-context prerequisite the CVSS vector cannot fully capture. Overall: a real priority for any multi-tenant Marten deployment, not an inflated-CVSS non-issue.

An application uses Marten LINQ with a dictionary field and passes a user-supplied value as the dictionary indexer/ContainsKey key (e.g. filtering documents by an attribute the user selects). The attacker submits a key containing a single quote such as "nonexistent' = '' or 1=1 --", breaking out of the generated single-quoted JSON-path literal to inject an always-true predicate that bypasses the filter and any per-tenant restriction, enabling blind exfiltration of other tenants' documents. No public standalone exploit is listed, but the vendor's fix PR contains proof-of-concept attack strings.