EUVD-2026-81263

Marten's LINQ provider has SQL injection via unescaped string literals...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via unescaped string literals in DictionaryItemMember, DictionaryContainsKeyFilter, SelectParser, DeleteAllForTenant, DatabaseScopedTenantPartitions, and EventLoader. An attacker can inject arbitrary SQL, bypass tenant or...

CVE-2026-75513

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary...

CVE-2026-75513

Marten is a .NET transactional document database and event store on PostgreSQL. Versions 7.0.0 through 9.13.0 are affected by a SQL injection vulnerability in several LINQ and tenant-management code paths that interpolate runtime strings into single-quoted SQL literals without escaping or paramet...