Marten
Monthly
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.0.0 through 9.12.x and lets an authenticated attacker who can influence strings reaching Marten's LINQ or tenant-management paths break out of single-quoted SQL/JSON-path literals and inject an always-true predicate, causing filter or multi-tenant authorization bypass and blind data exfiltration; on deployments that permit semicolon-batched Npgsql statements, data modification is also possible. The primary confirmed vector is a dictionary indexer key used in Where filters (src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs); Dictionary.ContainsKey is exploitable only under the Newtonsoft serializer, tenant identifiers reaching DeleteAllForTenant.cs via IEventStore.DeleteProjectionProgressAsync are likewise affected, and EventLoader.cs contains a related defense-in-depth sink. The vendor confirmed the issue in GHSA-rfx3-98h7-v3xp and fixed it in version 9.13.0 via PR #4911; no public exploit code was identified at time of analysis, and exploitation requires the host application to route attacker-controlled strings into one of these Marten paths.
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.0.0 through 9.12.x and lets an authenticated attacker who can influence strings reaching Marten's LINQ or tenant-management paths break out of single-quoted SQL/JSON-path literals and inject an always-true predicate, causing filter or multi-tenant authorization bypass and blind data exfiltration; on deployments that permit semicolon-batched Npgsql statements, data modification is also possible. The primary confirmed vector is a dictionary indexer key used in Where filters (src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs); Dictionary.ContainsKey is exploitable only under the Newtonsoft serializer, tenant identifiers reaching DeleteAllForTenant.cs via IEventStore.DeleteProjectionProgressAsync are likewise affected, and EventLoader.cs contains a related defense-in-depth sink. The vendor confirmed the issue in GHSA-rfx3-98h7-v3xp and fixed it in version 9.13.0 via PR #4911; no public exploit code was identified at time of analysis, and exploitation requires the host application to route attacker-controlled strings into one of these Marten paths.